Spot The Difference

Platform: broncoctf2026 | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-07-11 | Status: Solved Techniques: case_insensitive_filtering, decoy_noise_removal, per_character_diff

Summary

Task: two near-identical files of random-looking ASCII differ in 79 positions; a naive diff yields garbage. Solution: most diffs are decoy case flips — filter them out with a case-insensitive comparison and read the remaining substantive characters from file2 to recover the flag.

Spot The Difference — broncoctf2026

Description

My friend said that she updated file1 to send me a top-secret message, but I don't get it. File2 is still just a bunch of random characters?

Two files are provided: file1.txt (350 chars) and file2.txt (351 chars). Both are ASCII text that look like random character junk of similar length. The goal is to recover the "top-secret message" hidden in the update from file1 to file2.

Analysis

The two files are stored one character per line and are nearly identical. A byte-level diff shows they differ in 79 positions:

 bash read-only • copy allowed Copy
cmp -l file1.txt file2.txt   # 79 differing byte positions

Reading all 79 differing characters straight out of file2 produces garbage — this is the trap. The key insight is that the overwhelming majority of those 79 differences are pure case flips (e↔E, W↔w, C↔c, ...). These case-only edits are decoy / noise deliberately inserted to make a lazy diff produce nonsense.

The real payload lives only in positions where the two characters differ by more than letter case — i.e. where file1[i].lower() != file2[i].lower(). Filtering on this condition leaves exactly 29 substantive differences:

file1 side: gd6VeBn9ltja5VoTt3WmTyThP5q[C
file2 side: bronco{REDACTED}[C

Reading the file2 side up to the closing brace gives the flag. The trailing [C is spillover from the 1-character length mismatch between the files and lies outside the closed {...} braces.

Solution

Compare the two files character by character, discard every position that is only a case flip, and concatenate the surviving file2 characters.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pathlib import Path

a = Path('file1.txt').read_text().splitlines()
b = Path('file2.txt').read_text().splitlines()

# Keep only genuine (non-case-only) differences; read them from file2.
flag = ''.join(y for x, y in zip(a, b) if x.lower() != y.lower())
print(flag)  # bronco{REDACTED}[

The output is bronco{REDACTED}[; everything through the closing } is the flag.