Crack the Gate 1

When connecting to the website we find ourselves in front of a login form.

We want to find the endpoints of this form, and we can do that by looking at the source code of the webpage. (With most browsers you can right click and clikc on 'View Page Source').

Step 1 - Analyze the Page Source

Looking at the source code we find some comments:

Step 2 - Decrypt the hidden message

We observe that this ciphertex has a pattern, so we can guess that the message has been encrypted using a shift ciphert. Trying all possibilities we obtain the following: 

                
                    NOTE: Jack - temporary bypass: use header "X-Dev-Access: yes"

Step 3 - Login

Now using this information we send a request to the form using the mail provided, a random passowrd and adding the HTTP header to our request. This gives us the flag.

Adding an header to the HTTP request can be done using the web browser extension ModHeader, or by manually sending the request using cURL or a script.

picoCTF 2025 – Web Exploitation • Easy

Lessons Learned