> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CyberTalents - Easy Message Web Challenge Writeup
- URL: https://taiwanding.com/en/cybertalents-easy-message-writeup/
- Published: 2025-09-02T07:44:08.000Z
- Updated: 2026-08-04T06:18:34.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## Challenge Info

- **Platform**: CyberTalents
- **Category**: Web Security
- **Difficulty**: Easy (50 points)
- Challenge link: [https://cybertalents.com/challenges/web/easy-message](https://cybertalents.com/challenges/web/easy-message?ref=taiwanding.com)

## Walkthrough

### Step 1: Directory Scanning

Use gobuster to scan for hidden files:

```bash
gobuster dir -u http://[target-url]/ \
  -w /usr/share/seclists/Discovery/Web-Content/common.txt

```

This reveals a hidden parameter:

```
/?source

```

### Step 2: Source Code Analysis

Visiting `/?source` returns the PHP source code:

```php
if ($user == base64_decode('Q3liZXItVGFsZW50') &&
    $pass == base64_decode('Q3liZXItVGFsZW50'))
```

### Step 3: Base64 Decoding

Decode the credentials:

[Encoding/Decoding ToolEnter text Base64 encode decode URL encode decode output result 📋 Copy result 🔄 Swap input and output 🗑️ Clear all![](https://taiwanding.com/content/images/icon/favicon.ico)肉's LabKevin Chen![](https://taiwanding.com/content/images/thumbnail/photo-1626853884388-4bb1ff912ea6)](https://taiwanding.com/en/online-encoder-decoder-tool/)

```javascript
atob('Q3liZXItVGFsZW50')
// Result: 'Cyber-Talent'

```

**Login credentials**:

- Username: `Cyber-Talent`
- Password: `Cyber-Talent`

### Step 4: Morse Code Found After Login

```
..-. .-.. .- --. -.--. .. -....- -.- -. ----- .-- -....- -.-- ----- ..- -....- .- .-. ...-- -....- -- ----- .-. ... ...-- -.--.-

```

### Step 5: Decoding the Morse Code

Use an online Morse code translator to decode it:

[Online Morse Code TranslatorAn online Morse code translator that supports encoding text (including Chinese) into Morse code and decoding Morse code back into plain text. It can play Morse code audio online and download Morse code sound files. Text supports all Unicode characters.![](https://taiwanding.com/content/images/icon/icon.png)![](https://taiwanding.com/content/images/thumbnail/icon-1732875babb6f45ec2e61eaf37a1c0f0.png)](https://www.lddgo.net/encrypt/morse?ref=taiwanding.com)

**The flag**:

```
FLAG(I-****-***-***-*****)

```

## Key Takeaways

- **Directory scanning matters**: the `?source` parameter is easy to overlook
- **Layered encoding**: a Base64 → Morse code combination
- **Source code disclosure**: `?source` is a common source-code-leak parameter

## Handy Tips

```bash
# Other common source-code-leak parameters
?debug=1
?source=1
?view-source
?view=source

```