Treasure Hunt

Platform: Tjctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-05-15 | Status: Solved Techniques: html_source_inspection, http_header_analysis, post_form_submission_analysis, robots_txt_enumeration

Summary

Task: Web reconnaissance challenge with flag split into 4 parts hidden across HTML source, HTTP headers, and standard web files. Solution: Inspect page source for hidden <p> tag, check robots.txt for disallowed endpoints, and analyze Set-Cookie header from POST form submission.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: tjctf | ID: 20260515_tjctf_treasure_hunt
• Tags: http_cookies, web_reconnaissance, robots_txt, multi_part_flag, gunicorn, beginner, hidden_html, set_cookie_header
• Indicators: flag split into multiple parts, challenge mentions treasure hunt or scavenger hunt, hidden HTML elements in page source, robots.txt with Disallow entries, Set-Cookie header on form submission contains flag fragment
• Source: 20260515_tjctf_treasure_hunt.md

Foothold

Vulnerability / Misconfiguration

1. Html_source_inspection
2. Http_header_analysis
3. Post_form_submission_analysis
4. Robots_txt_enumeration

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• html_source_inspection
• http_header_analysis
• post_form_submission_analysis
• robots_txt_enumeration
• Tags: http_cookies, web_reconnaissance, robots_txt, multi_part_flag, gunicorn, beginner, hidden_html, set_cookie_header

Original Writeup

<details><summary>Click to expand original content</summary>

Treasure Hunt — TJCTF 2026

Description

let us go hunt down some treasure! The flag is split into 4 parts. I'll give you the first one right here: tjctf

English summary: A pirate-themed web page at https://treasure-hunt.tjc.tf running on gunicorn (Python WSGI). The flag is split into 4 parts hidden in different standard web locations. The first part is given in the challenge description.

Analysis

The main page is a pirate-themed site with a ship image and a "Learn More" button (POST form). The server runs gunicorn. Standard web reconnaissance locations need to be checked: HTML source, HTTP headers, robots.txt, and common endpoints.

Key observations:

• The page has a hidden HTML element not visible in the rendered page
• The "Learn More" button triggers a POST request that redirects to /extra_info (a red herring with a penguin image)
• The POST response includes a Set-Cookie header with a flag fragment
• robots.txt disallows a /gold-coffer endpoint

Solution

Part 1: Challenge Description → tjctf

Given directly in the challenge text.

Part 2: Hidden HTML Element → _and_

Viewing the page source reveals a hidden paragraph tag:

curl -s https://treasure-hunt.tjc.tf

<p hidden>_and_</p>

This element is not rendered by the browser but is visible in the HTML source.

Part 3: Set-Cookie Header → {s1lv3r

Submitting the POST form (clicking "Learn More") and inspecting the response headers:

curl -sv -X POST https://treasure-hunt.tjc.tf 2>&1 | grep -i set-cookie

Set-Cookie: silver_coffer={s1lv3r; Path=/

The server responds with a 302 redirect to /extra_info (which shows a penguin image — a red herring) and sets a cookie named silver_coffer containing the third flag part.

Part 4: robots.txt → Disallowed Endpoint → g0ld}

Checking the standard robots.txt file:

curl -s https://treasure-hunt.tjc.tf/robots.txt

User-agent: *
Disallow: /gold-coffer
Allow: /

Visiting the disallowed endpoint:

curl -s https://treasure-hunt.tjc.tf/gold-coffer

Returns the plain text: g0ld}

Flag Assembly

Combining all 4 parts in order:

Flag: tjctf{REDACTED}

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR