Treasure Hunt

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: html_source_inspection, http_header_analysis, post_form_submission_analysis, robots_txt_enumeration

Summary

Walkthrough of the CUSTOM Web Treasure Hunt. Task: Web reconnaissance challenge with flag split into 4 parts hidden across HTML source, HTTP headers, and standard web files. Solution: Inspect page source for hidden <p> tag, check robots.txt for

---

title: "Treasure Hunt" id: 20260515_tjctf_treasure_hunt category: web difficulty: easy event: tjctf tags: ["http_cookies", "web_reconnaissance", "robots_txt", "multi_part_flag", "gunicorn", "beginner", "hidden_html", "set_cookie_header"] techniques: ["html_source_inspection", "http_header_analysis", "post_form_submission_analysis", "robots_txt_enumeration"] tools: ["curl", "browser_devtools"] indicators: ["flag split into multiple parts", "challenge mentions treasure hunt or scavenger hunt", "hidden HTML elements in page source", "robots.txt with Disallow entries", "Set-Cookie header on form submission contains flag fragment", "red herring pages to distract from real flag locations"]

Treasure Hunt — TJCTF 2026

Description

Let's go hunt down some treasure! The flag is split into 4 parts. I'll give you the first one right here: tjctf

English summary: A pirate-themed web page at https://treasure-hunt.tjc.tf running on gunicorn (Python WSGI). The flag is split into 4 parts hidden in different standard web locations. The first part is given in the challenge description.

Analysis

The main page is a pirate-themed site with a ship image and a "Learn More" button (POST form). The server runs gunicorn. Standard web reconnaissance locations need to be checked: HTML source, HTTP headers, robots.txt, and common endpoints.

Key observations:

• The page has a hidden HTML element not visible in the rendered page
• The "Learn More" button triggers a POST request that redirects to /extra_info (a red herring with a penguin image)
• The POST response includes a Set-Cookie header with a flag fragment
• robots.txt disallows a /gold-coffer endpoint

Solution

Part 1: Challenge Description → tjctf

Given directly in the challenge text.

Part 2: Hidden HTML Element → _and_

Viewing the page source reveals a hidden paragraph tag:

 bash read-only • copy allowed Copy
curl -s https://treasure-hunt.tjc.tf

 html read-only • copy allowed Copy
<p hidden>_and_</p>

This element is not rendered by the browser but is visible in the HTML source.

Part 3: Set-Cookie Header → {s1lv3r

Submitting the POST form (clicking "Learn More") and inspecting the response headers:

 bash read-only • copy allowed Copy
curl -sv -X POST https://treasure-hunt.tjc.tf 2>&1 | grep -i set-cookie

Set-Cookie: silver_coffer={s1lv3r; Path=/

The server responds with a 302 redirect to /extra_info (which shows a penguin image — a red herring) and sets a cookie named silver_coffer containing the third flag part.

Part 4: robots.txt → Disallowed Endpoint → g0ld}

Checking the standard robots.txt file:

 bash read-only • copy allowed Copy
curl -s https://treasure-hunt.tjc.tf/robots.txt

User-agent: *
Disallow: /gold-coffer
Allow: /

Visiting the disallowed endpoint:

 bash read-only • copy allowed Copy
curl -s https://treasure-hunt.tjc.tf/gold-coffer

Returns the plain text: g0ld}

Flag Assembly

Combining all 4 parts in order:

Flag: tjctf{REDACTED}

Key Takeaways / Lessons

• Mastering html_source_inspection, http_header_analysis, post_form_submission_analysis, robots_txt_enumeration was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-15 • CUSTOM • Treasure Hunt • Difficulty: Easy