Recursion

Platform: spbctf | Category: Crypto | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: iframe_chain_following, recursive_crawling

Summary

Task: HTML page with nested iframes forming a chain. Solution: Follow the iframe chain recursively until 404, the last existing filename is the flag.

Recursion — Crypto Kids 2.0

Description

HTML page with nested iframes. Need to follow the chain to the end.

Analysis

• index.html contains an iframe pointing to 741761685.html
• Each page contains an iframe to the next numbered page
• The chain continues for 100 iterations
• At step 100, the iframe points to 1337.html, which returns 404
• The last existing file is REDACTED.html
• Flag = name of the last existing file (without .html)

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests
import re
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

base_url = "http://challenge.example.com/"  # URL from the task
current_page = "index.html"

for step in range(150):  # With margin
    url = base_url + current_page
    try:
        response = requests.get(url, timeout=5)
        if response.status_code == 404:
            print(f"Step {step}: 404 on {current_page}")
            break
        
        # Find iframe src
        match = re.search(r'<iframe[^>]+src=["\']([^"\']+)["\']', response.text)
        if not match:
            print(f"Step {step}: No iframe found in {current_page}")
            print(f"Content: {response.text[:500]}")
            break
        
        next_page = match.group(1)
        print(f"Step {step}: {current_page} -> {next_page}")
        current_page = next_page
        
    except requests.RequestException as e:
        print(f"Step {step}: Error on {current_page}: {e}")
        break
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# The last successful file before 404 is the flag
# REDACTED.html -> flag = REDACTED

Alternative Solution (curl + bash)

 bash read-only • copy allowed Copy
#!/bin/bash
URL="http://challenge.example.com/"
PAGE="index.html"

for i in $(seq 1 150); do
    CONTENT=$(curl -s "${URL}${PAGE}")
    if [ $? -ne 0 ]; then
        echo "Step $i: Failed to fetch $PAGE"
        break
    fi
    
    NEXT=$(echo "$CONTENT" | grep -oP 'src="\K[^"]+(?=")' | head -1)
    if [ -z "$NEXT" ]; then
        echo "Step $i: No iframe in $PAGE"
        echo "Last page: $PAGE"
        break
    fi
    
    echo "Step $i: $PAGE -> $NEXT"
    PAGE="$NEXT"
done
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Extract number from filename
echo "Flag: ${PAGE%.html}"

Iframe Chain

index.html
  └── 741761685.html
        └── ...
              └── REDACTED.html  <- last existing
                    └── 1337.html (404)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍