HIDDEN SOURCE CODE (PicoCTF 2022 #13 'inspect-html')

Key Takeaways

ladies and gentlemen welcome back to another youtube video showcasing the pico ctf 2022 capture the flag in the last video we got to dig through some html css javascript the beginning fundamentals foundations for web exploitation that we might continue on and do forward and we finally finished 12 challenges and cracked our way through the first page of the pico ctf game so now we're moving on and doing some more fun stuff and uh let's get to it over here in my cali virtual machine of course i'm navigating the pico ctf webpage and we're cruising onward to another web exploitation challenge called inspect html might be kind of another symbol simple similar one as the last challenge it says can you get the flag go to this website and see what you can discover a-okay ooh on his his dice i don't know what that is i don't know what any of this is and i i don't want to read it so i'm i'm not going to um but look i mentioned previously hey it's cool to see what this web page is showing us what it's willing to give us outright but i want to dig into the cool stuff i want to dig into the internals i want to see how it's made and put together i want to look at the source code best way to do that right click and view page source and there we okay that is that challenge there is our flag so look i mentioned in the previous video you you know comments in scripting languages programming languages markup languages etc um we saw it in pico sorry in python with the octothorpe with that hashtag or pound symbol we also just as well saw it in python well no i just said that we saw it in jscript dude i'm falling apart i saw it in javascript right with the two forward slashes just the same way we saw it in the c programming language you also saw in css the cascading style sheets forward slash and the asterisks and c does that just as well for multi-line or multi-block comments now html html uses these greater than and less than symbols to denote an element right for for markup with an exclamation point and two hyphens to note the beginning and ending of the comment it's not going to be rendered out on the page of course we didn't see that when we were just looking at how the web browser presented to us but it's still going to be included and something that we can see as a client and user receiving this html page and content maybe sometimes there's some spooky secrets i don't know shenanigans that might be included in there in this case hey it's our flag and that's that like can i even should i is it even worth making a directory for this thing hey we'll do it just for the i don't know completion's sake we could probably like legit solve this we'll write a get flag script here let's use curl to download this webpage and let's grep again taco e pico ctf with the flag format just like that using curl rather than wget to be able to download and see the source page curl will need us to remain silent we attack s there and then grep of course will want to remove the color with tactec color equals none my face in the way no i'm good i'm in the clear that's it we can save that there's our get flag script there is our flag.text and we can finish that challenge wow a lot of good learning coming from that one uh i hope you guys had fun one of the other things like man should i even upload this but hey we had some fun i hope you enjoyed and i'll let you get back to it everybody i love you i'll see you in the next video