Приключение с флагом (Flag Adventure)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: CSS file analysis, HTML source code inspection, JavaScript file analysis, Standard file enumeration (robots.txt)

Summary

Walkthrough of the CUSTOM Web Приключение с флагом (Flag Adventure). Task: Find 4 hidden parts of the flag in a web application. Solution: Web reconnaissance - checking HTML comments, JavaScript files, CSS files, and robots.txt to collect all flag parts.

Description

Я спрятал 4 части флага, попробуй их найти)

A simple web reconnaissance task. The goal is to find 4 parts of the flag hidden in various places within the web application.

Analysis

The task description directly indicates that the flag is split into 4 parts. This is a typical beginner task that tests knowledge of basic places where data can be hidden in a web application:

1. HTML comments
2. JavaScript files
3. CSS files
4. Standard files (robots.txt, sitemap.xml, etc.) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Part 1 - HTML Comment

Viewing the source code of the main page:

 bash read-only • copy allowed Copy
curl -s http://62.173.140.174:16001

An HTML comment was found in the <head> section:

 html read-only • copy allowed Copy
<!-- part1: CODEBY{y0u -->

Part 2 - JavaScript Comment

Analyzing the JavaScript file:

 bash read-only • copy allowed Copy
curl -s http://62.173.140.174:16001/js/main.js

A comment was found in the code:

 javascript read-only • copy allowed Copy
// Change text color part2: _f0und_ on mouseout

Part 3 - CSS Comment

Analyzing the CSS file:

 bash read-only • copy allowed Copy
curl -s http://62.173.140.174:16001/css/style.css

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

A comment was found in the styles:

 css read-only • copy allowed Copy
background: linear-gradient(to right, #24243e, #3a3476, #0f0c29); /* W3C, IE 10+/ Edge, Firefox 16+, Chrome 26+, Opera 12+, part3: th3m_,  Safari 7+ */

Part 4 - robots.txt

Checking the standard robots.txt file:

 bash read-only • copy allowed Copy
curl -s http://62.173.140.174:16001/robots.txt

Contents:

# part4: 4ll}

Assembling the Flag

Combining all parts:

• Part 1: CODEBY{y0u
• Part 2: _f0und_
• Part 3: th3m_
• Part 4: 4ll}

Checklist for Similar Tasks

1. HTML: View page source code (Ctrl+U), search for comments <!-- -->
2. JavaScript: Check all .js files, search for comments // and /* */
3. CSS: Check all .css files, search for comments /* */
4. Standard files: robots.txt, sitemap.xml, .htaccess, humans.txt
5. Metadata: HTTP headers, meta tags
6. Hidden elements: display:none, visibility:hidden, white text on white background ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering CSS file analysis, HTML source code inspection, JavaScript file analysis, Standard file enumeration (robots.txt) was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2025-12-24 • CUSTOM • Приключение с флагом (Flag Adventure) • Difficulty: Easy