CyberTalents - Easy Message Web Challenge Writeup

Challenge Info

• Platform: CyberTalents
• Category: Web Security
• Difficulty: Easy (50 points)
• Challenge link: https://cybertalents.com/challenges/web/easy-message

Walkthrough

Step 1: Directory Scanning

Use gobuster to scan for hidden files:

gobuster dir -u http://[target-url]/ \
  -w /usr/share/seclists/Discovery/Web-Content/common.txt

This reveals a hidden parameter:

/?source

Step 2: Source Code Analysis

Visiting /?source returns the PHP source code:

if ($user == base64_decode('Q3liZXItVGFsZW50') &&
    $pass == base64_decode('Q3liZXItVGFsZW50'))

Step 3: Base64 Decoding

Decode the credentials:

Encoding/Decoding Tool

Enter text Base64 encode decode URL encode decode output result 📋 Copy result 🔄 Swap input and output 🗑️ Clear all

肉's LabKevin Chen

atob('Q3liZXItVGFsZW50')
// Result: 'Cyber-Talent'

Login credentials:

• Username: Cyber-Talent
• Password: Cyber-Talent

Step 4: Morse Code Found After Login

..-. .-.. .- --. -.--. .. -....- -.- -. ----- .-- -....- -.-- ----- ..- -....- .- .-. ...-- -....- -- ----- .-. ... ...-- -.--.-

Step 5: Decoding the Morse Code

Use an online Morse code translator to decode it:

Online Morse Code Translator

An online Morse code translator that supports encoding text (including Chinese) into Morse code and decoding Morse code back into plain text. It can play Morse code audio online and download Morse code sound files. Text supports all Unicode characters.

The flag:

FLAG(I-****-***-***-*****)

Key Takeaways

• Directory scanning matters: the ?source parameter is easy to overlook
• Layered encoding: a Base64 → Morse code combination
• Source code disclosure: ?source is a common source-code-leak parameter

Handy Tips

# Other common source-code-leak parameters
?debug=1
?source=1
?view-source
?view=source