RowdyHacks XII: YOUR FIRST CTF!!!

Challenge

Workshop · 25 points. The beginner workshop paired an in-person CTFd challenge with a small check-in website that asks what else its page loaded.

Approach

Viewing the page source shows the check-in page pulls in check-in.js. An HTML comment holds rowdy{not_the_real_flag}, a deliberate decoy to catch anyone who stops at "view source." The real website flag is in the script, wrapped in an atob(...) Base64 string:

# extract the atob("...") argument from check-in.js and decode it
python3 -c "import base64; print(base64.b64decode('<string>').decode())"

Note on the two flags

This challenge has two distinct answers. The in-person CTFd flag was given during the workshop and is what scores the 25 points. The website flag above is a separate artifact recovered from the JavaScript and is valid only on that site. Submitting it to CTFd returns incorrect. Keeping the two straight was the real lesson of the warm-up.

Takeaway

Everything shipped to the browser is readable, so a base64 string in the page JavaScript is encoding, not a secret, and the decoy comment protected nothing. The lesson scales straight to real apps: the client is public, so anything that must stay secret stays server-side.

Flags

CTFd (scored):  rowdy{welcome_to_your_first_ctf!}
Website (JS):   rowdy{youFoundMe}