Looking Down

Platform: bluehensctf | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-04-22 | Status: Solved Techniques: keyboard_shape_recognition, visual_pattern_matching

Summary

Task: decode three strange QWERTY-looking character groups with no files or extra hints. Solution: use the title clue to view each group as pressed keys on a keyboard, de-stagger the rows visually, and read the resulting letters H, E, and N.

Looking Down — BlueHens CTF 2026

Description

1qazs3edc 456rfvbngh 7ujmil0p;/

We are given a single line of seemingly random keyboard characters. The goal is to recognize the intended visual pattern and recover the plaintext hidden inside it.

Analysis

The title Looking Down is the main hint. Instead of treating the string as a substitution cipher or encoded text, the right approach is to literally look down at a standard QWERTY keyboard.

The ciphertext is split into three groups:

1. 1qazs3edc
2. 456rfvbngh
3. 7ujmil0p;/ ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Each group uses characters that sit near each other on the keyboard. If we mark those keys and mentally remove the normal row stagger, the pressed keys form block letters.

Solution

1. Split the text on spaces into three clusters.
2. Plot each cluster on a standard QWERTY keyboard.
3. Ignore the row offsets and view the selected keys as a straight grid.
4. Read the three resulting letters.

Keyboard-style interpretation

For reference, the relevant keyboard rows are:

 text read-only • copy allowed Copy
1234567890
qwertyuiop
asdfghjkl;
zxcvbnm,./

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Group 1: 1qazs3edc → H

 text read-only • copy allowed Copy
1 . 3
q . e
a s d
z . c

The left and right columns are filled, with s in the center bar, so the shape reads as H.

Group 2: 456rfvbngh → E

 text read-only • copy allowed Copy
4 5 6
r . .
f g h
v . .
b n .

Viewed as a de-staggered block, this gives a vertical spine on the left with top, middle, and bottom strokes, which reads as E.

Group 3: 7ujmil0p;/ → N

 text read-only • copy allowed Copy
7 . . 0
. u . p
. j . ;
. m i /
. . l

This forms two vertical sides connected by a diagonal, which reads as N. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

So the plaintext is:

 text read-only • copy allowed Copy
HEN

BlueHens-themed plaintext gives the final flag:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
groups = {
    "1qazs3edc": "H",
    "456rfvbngh": "E",
    "7ujmil0p;/": "N",
}

plaintext = "".join(groups[g] for g in ["1qazs3edc", "456rfvbngh", "7ujmil0p;/"])
flag = f"UDCTF{{{plaintext}}}"

print(plaintext)
print(flag)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍