Loginator (Логинатор)

Platform: duckerz | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: log_file_analysis, pattern_recognition, url_path_extraction

Summary

Task: Analyze web server log dump after a DOS attack. Solution: Extract single characters from unusual URL paths (/flag.php/X) and concatenate them to reveal the flag.

Loginator (Логинатор) — DUCKERZ CTF

Description

После проведения DOS атаки, был выгружен дамп логов.

(After a DOS attack, a log dump was extracted.)

Files: loginator.txt (52KB, web server log file)

Analysis

Initial Examination

Download and analyze the log file:

 bash read-only • copy allowed Copy
curl -sL "https://download.tasks.duckerz.ru/Loginator/loginator.txt" -o loginator.txt
file loginator.txt
# CSV text (web server logs)

The file contains web server logs in CSV format with fields:

• Timestamp
• HTTP Method
• Path
• IP Address
• User
• User Agent ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Finding Anomalies

While reviewing the logs, unusual entries were discovered — PUT requests to paths like /flag.php/X, where X is a single character:

/flag.php/D
/flag.php/U
/flag.php/C
/flag.php/K
...

This is a clear sign of hidden data encoded in URL paths of requests.

Solution

Step 1: Extract flag.php Entries

 bash read-only • copy allowed Copy
grep "flag.php" loginator.txt

Find all entries containing requests to flag.php. Entries are ordered chronologically by timestamp.

Step 2: Extract Flag Characters

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
grep "flag.php" loginator.txt | sed 's/.*\/flag.php\/\(.\).*/\1/' | tr -d '\n'

Command breakdown:

• grep "flag.php" — filters lines containing flag.php
• sed 's/.*\/flag.php\/\(.\).*/\1/' — extracts one character after /flag.php/
• tr -d '\n' — removes newlines, joining characters together

Result

DUCKERZ{REDACTED}

Alternative Approaches

Python Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import re

with open('loginator.txt', 'r') as f:
    content = f.read()

# Extract characters from paths /flag.php/X
matches = re.findall(r'/flag\.php/(.)', content)
flag = ''.join(matches)
print(flag)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Awk Solution

 bash read-only • copy allowed Copy
awk -F'/flag.php/' '{if(NF>1) printf substr($2,1,1)}' loginator.txt

Conclusions

A classic forensics task on log analysis. Data was hidden in URL paths of HTTP requests — each request to /flag.php/X contained one character of the flag. The chronological order of entries in the log preserved the correct sequence of characters.

Lesson: When analyzing logs, always pay attention to:

• Unusual request paths
• Repeating patterns
• Single characters in URLs
• Requests to non-existent or suspicious files ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍