Description

A login page is served by a Node.js server. The authentication logic lives in an index.js file served publicly. The flag is hidden inside that file.

Overview

• The server exposes index.js at a known URL.
• That file contains the flag base64-encoded and hardcoded into the JavaScript source.
• Fetching the file and decoding the string yields the flag directly.

Solution

Step 1: Fetch index.js

• The server URL ends with a JavaScript filename, accessible with a direct GET request.

r = requests.get("https://login.mars.picoctf.net/index.js")

Step 2: Find the Encoded String

• Reading index.js reveals a base64-encoded string hardcoded in the source:

cGljb0NURns1M3J2M3JfNTNydjNyXzUzcnYzcl81M3J2M3JfNTNydjNyfQ==

• The string is used as one side of a comparison in the authentication logic, which means it encodes either the correct password or the flag itself.

Step 3: Decode

• Base64 decoding the string immediately gives the flag.

import base64
encoded = "cGljb0NURns1M3J2M3JfNTNydjNyXzUzcnYzcl81M3J2M3JfNTNydjNyfQ=="
result = base64.b64decode(encoded).decode()

Why This Is Broken

• Base64 is an encoding, not encryption: it is trivially reversible with no key.
• Storing the flag or a correct password client-side means any visitor can recover it by reading the source.
• The correct design is to hash credentials server-side and never send the expected value to the client.

Flag

picoCTF{53rv3r_53rv3r_53rv3r_53rv3r_53rv3r}