Исходный код (Source Code)

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: Client-side secret extraction, JavaScript source code analysis, Mathematical expression evaluation, String.fromCharCode() deobfuscation

Summary

Task: Authorization form with obfuscated JavaScript. Solution: Deobfuscate String.fromCharCode() calls in browser console to extract password and flag.

Исходный код — hackerlab

Description

Пройти авторизацию достаточно просто :)

Target: http://62.173.140.174:13001/

Analysis

1. Hint in the Task Name

The task name "Исходный код" (Source Code) directly hints at the need to view the page source code.

2. HTML Analysis

When viewing the authorization page source code, a linked JavaScript file was found:

 html read-only • copy allowed Copy
<script src="/static/js/script.js"></script>

3. JavaScript Obfuscation

The script.js file contains obfuscated code using String.fromCharCode(): ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 javascript read-only • copy allowed Copy
// Example of obfuscated code
var password = String.fromCharCode(118, 51, 114, 121, 115, 51, 99, 117, 114, 51, 112, 52, 115, 115, 108, 48, 108);

The obfuscation uses mathematical expressions instead of direct numbers:

 javascript read-only • copy allowed Copy
String.fromCharCode(100+18, 48+5, 110+4, ...)

4. Deobfuscation

Evaluating all mathematical expressions in fromCharCode() calls reveals:

• Password: v3rys3cur3p4ssl0l
• Flag: located in the showFlag() function

Solution

Method 1: Browser Console

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Open DevTools (F12) → Console and execute the obfuscated expressions:

 javascript read-only • copy allowed Copy
// Copy and execute String.fromCharCode(...) expressions
String.fromCharCode(118, 51, 114, 121, 115, 51, 99, 117, 114, 51, 112, 52, 115, 115, 108, 48, 108)
// Result: "v3rys3cur3p4ssl0l"

Method 2: Finding the showFlag Function

Find the showFlag() function in the source code and extract the flag directly:

 javascript read-only • copy allowed Copy
function showFlag() {
    alert(String.fromCharCode(67, 79, 68, 69, 66, 89, 123, 110, 49, 99, 51, 95, 106, 52, 118, 52, 115, 99, 114, 49, 112, 116, 95, 48, 98, 102, 117, 115, 95, 98, 114, 48, 125));
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Execution in console:

 javascript read-only • copy allowed Copy
String.fromCharCode(67, 79, 68, 69, 66, 89, 123, 110, 49, 99, 51, 95, 106, 52, 118, 52, 115, 99, 114, 49, 112, 116, 95, 48, 98, 102, 117, 115, 95, 98, 114, 48, 125)
// Result: "CODEBY{REDACTED}"

Method 3: Python Deobfuscator

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# String.fromCharCode deobfuscation

codes = [67, 79, 68, 69, 66, 89, 123, 110, 49, 99, 51, 95, 
         106, 52, 118, 52, 115, 99, 114, 49, 112, 116, 95, 
         48, 98, 102, 117, 115, 95, 98, 114, 48, 125]
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

flag = ''.join(chr(c) for c in codes)
print(flag)
# CODEBY{REDACTED}

Lessons

Main lesson: Client-side JavaScript obfuscation does NOT protect secrets!

Any code executed in the user's browser can be:

1. Viewed via View Source
2. Debugged via DevTools
3. Deobfuscated by executing in console

Server-side validation is required to protect secrets. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍