Прятки (Hide and Seek)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: HTTP User-Agent header manipulation, JavaScript protection bypass, Raw HTML source viewing to bypass client-side JS

Summary

Walkthrough of the CUSTOM Web Прятки (Hide and Seek). Task: Find hidden content on a page with JavaScript protection. Solution: Use curl with custom User-Agent to bypass client-side JS that removes the flag element from DOM.

Description

Кто не спрятался, я не виноват (Whoever didn't hide, it's not my fault)

The name and description hint at a game of hide and seek — we need to find something hidden.

Reconnaissance

Main Page

When opening in a browser, we see a Matrix-style animation with the heading "Locate Me If You Can".

Source Code Analysis

When trying to press Ctrl+U (view source code) — nothing happens. JavaScript blocks standard ways to view source.

Through DevTools (F12) or curl we can see the source code: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 javascript read-only • copy allowed Copy
this.client = 'not 31337';

This is an obvious hint — the client is "not 31337" (not "elite" in hacker slang).

Hidden Element

The HTML also contains:

 html read-only • copy allowed Copy
<secret id='flag'>CODEBY{...}</secret>

But JavaScript removes this element after the page loads:

 javascript read-only • copy allowed Copy
document.getElementById('flag').remove();

Therefore the flag is not visible in the browser — it gets removed before the user can see it.

Solution

Step 1: Changing User-Agent

The hint this.client = 'not 31337' indicates that we need to change the User-Agent to "31337" or a similar value: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -s -A "31337" http://62.173.140.174:16025

Step 2: Viewing Raw HTML

When requesting via curl we get raw HTML without JavaScript execution, so the <secret> element is not removed:

 html read-only • copy allowed Copy
<secret id='flag'>CODEBY{REDACTED}</secret>

Alternative Methods

1. View Source via browser menu: view-source:http://62.173.140.174:16025
2. DevTools Network tab: View raw response
3. wget: wget -q -O - http://62.173.140.174:16025
4. Disabling JavaScript: In browser settings or via extension ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Conclusions

This task demonstrates:

1. Client-side protection is useless — JavaScript runs on the client side and is easily bypassed
2. User-Agent spoofing — a simple way to get alternative content
3. Raw HTTP requests — curl/wget show the real server response without JS processing ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering HTTP User-Agent header manipulation, JavaScript protection bypass, Raw HTML source viewing to bypass client-side JS was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2025-12-24 • CUSTOM • Прятки (Hide and Seek) • Difficulty: Easy