Roboto Sans (Medium)

  • Challenge Link: https://play.picoctf.org/practice/challenge/291?category=1&difficulty=2&page=2
  • Challenge Description: The flag is somewhere on this web application not necessarily on the website. Find it.

Solution

Similar to another PicoCTF we did called "Where are the Robots?" but with extra steps. We need to use access the secret/hidden directory using 'robots.txt'. Quick reminder, robots.txt is a simple text file placed in a website's root directory that provides directives web crawlers about which parts of the site they are allowed or not allowed to crawl and index.

The front page, you can try using inspect element but you won't find anything useful:

http://saturn.picoctf.net:53917/robots.txt
Front

Looking at the robots.txt file, the directories /cgi-bin/ and /wp-admin/ doesn't contain anything.

Robots

Using a decoder on the 3 ciphertext, first and third ciphertext outputs gibberish, while the second ciphertext, if you remove the ==, you get a new directory.

ZmxhZzEudHh0;anMvbXlmaW
anMvbXlmaWxlLnR4dA==
svssshjweuiwl;oiho.bsvdaslejg
js/myfile.txt
Decoder

Using the new directory to find the flag

http://saturn.picoctf.net:53917/js/myfile.txt
picoCTF{Who_D03sN7_L1k5_90B0T5_718c9043}
Flag

Sources