vault-door-5 picoCTF 2019 Solution

Description

1. Step 1Read the Java source and identify the encoding chain
   Open VaultDoor5.java. The checkPassword method applies Base64 encoding and URL encoding to the input, then compares it to a stored string. To reverse this: the stored string is URL-decoded, then Base64-decoded, to recover the password.
   bash

   cat VaultDoor5.java

   Copied!
   Learn more

   Base64 encodes binary data as printable ASCII characters (A-Z, a-z, 0-9, +, /). It inflates the data by 33% and is reversible without a key.

   URL encoding (percent encoding) replaces special characters with a percent sign followed by their hex code (e.g., space becomes %20). This ensures text can be safely embedded in URLs.

   These are encodings, not encryption - they provide zero confidentiality. Anyone who recognizes the encoding chain can reverse it instantly.

2. Step 2Reverse the encoding chain
   Extract the stored encoded string from the Java source. First URL-decode it, then Base64-decode the result. The output is the password to submit.
   bash

   # URL-decode then Base64-decode the stored string:

   Copied!

   python

   python3 -c "import urllib.parse, base64; s = '<paste stored string>'; print(base64.b64decode(urllib.parse.unquote(s)).decode())"

   Copied!
   Learn more

   Python's urllib.parse.unquote() performs URL decoding. base64.b64decode() performs Base64 decoding. Chain them in the reverse order of the encoding (URL-decode first, then Base64-decode) to recover the plaintext.

Alternate Solution

Flag

The password went through URL encoding then Base64 encoding before storage - reverse by URL-decoding then Base64-decoding.