Basic Workout

Platform: CUSTOM | Category: Crypto | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: api_automation, encoding_recognition, session_management

Summary

Walkthrough of the CUSTOM Crypto Basic Workout. URL: https://basicworkout.forkbomb.ru/

Description

"Этот тренажёр даст накачать мышцу узнавания кодировок глазами"

URL: https://basicworkout.forkbomb.ru/

Need to correctly identify 37 encodings in a row.

Analysis

The site provides an API for getting encoded text and verifying answers:

• /gettask — get encoded text
• /verify — submit answer with encoding type

Supported encodings:

• base2: only characters 0 and 1
• base16: only 0-9, a-f, even length
• base32: only A-Z, 2-7, =
• base58: alphanumeric without 0, O, I, l
• base64: A-Za-z0-9+/=
• base256: raw ASCII/binary text ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Encoding Recognition Patterns

1. base2: ^[01]+$ — only zeros and ones
2. base16: ^[0-9a-fA-F]+$ and even length
3. base32: ^[A-Z2-7]+=*$ — uppercase letters, digits 2-7, padding
4. base58: ^[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]+$ — without 0, O, I, l
5. base64: ^[A-Za-z0-9+/]+=*$ — standard base64 alphabet
6. base256: contains non-printable characters or doesn't match other patterns

Automated Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests
import re
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

BASE_URL = "https://basicworkout.forkbomb.ru"

def identify_encoding(data):
    """Identifies encoding type by characteristic patterns"""
    
    # base2: only 0 and 1
    if re.fullmatch(r'[01]+', data):
        return 'base2'
    
    # base16: only hex characters, even length
    if re.fullmatch(r'[0-9a-fA-F]+', data) and len(data) % 2 == 0:
        return 'base16'
    
    # base32: A-Z, 2-7, possibly =
    if re.fullmatch(r'[A-Z2-7]+=*', data):
        return 'base32'
    
    # base64: standard alphabet with +/=
    if re.fullmatch(r'[A-Za-z0-9+/]+=*', data):
        return 'base64'
    
    # base58: without 0, O, I, l
    base58_chars = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
    if all(c in base58_chars for c in data):
        return 'base58'
    
    # base256: everything else (binary data)
    return 'base256'
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def solve():
    session = requests.Session()
    correct = 0
    
    while correct < 37:
        # Get task
        resp = session.get(f"{BASE_URL}/gettask")
        task_data = resp.json()
        encoded = task_data['encoded']
        
        # Identify encoding
        encoding = identify_encoding(encoded)
        
        # Submit answer
        verify_resp = session.post(f"{BASE_URL}/verify", json={'answer': encoding})
        result = verify_resp.json()
        
        if result.get('correct'):
            correct += 1
            print(f"[{correct}/37] {encoding} ✓")
        else:
            correct = 0
            print(f"[RESET] Wrong: {encoding}, expected: {result.get('expected')}")
        
        # Check for flag
        if 'flag' in result:
            print(f"\n🎉 FLAG: {result['flag']}")
            return result['flag']
    
    return None
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    solve()

Key Points

1. Check order matters: first check stricter patterns (base2), then less strict ones
2. Session management: use requests.Session() to preserve cookies/state
3. Reset handling: on error the counter resets, need to start over ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering api_automation, encoding_recognition, session_management was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Basic Workout • Difficulty: Medium