Skip to main content
picoCTF Solutions
picoCTF 2020 Mini-CompetitionGeneral SkillsMedium

Nothing Up My Sleeve picoCTF 2020 Mini-Competition Solution

A general skills challenge involving a weak pseudorandom number generator and a custom cipher.

Published: April 2, 2026Updated: August 25, 2026

Description

This challenge promises that nothing is hidden: the flag is 'in-the-clear.' Your only task is to retrieve the file from the challenge server and read it.

Setup

Download the file from the challenge page.

bash
wget <challenge_url>/nothing_up_my_sleeve

Solution

Want to try it yourself first?

The guided walkthrough reveals hints one step at a time.

Walk me through it
  1. Step 1Download and read the file
    Observation
    The description says the flag is in the clear, so nothing is encoded or obfuscated. Downloading the file and printing it with cat should be the whole solution.
    Use wget (or curl) to download the file from the URL provided on the challenge page, then print its contents with cat. The flag is stored as plain ASCII text with no encoding, encryption, or steganography.
    bash
    wget <challenge_url>/nothing_up_my_sleeve
    bash
    cat nothing_up_my_sleeve
    What didn't work first

    Tried: Run 'strings nothing_up_my_sleeve' expecting to extract hidden text from a binary.

    The file is plain ASCII, so strings prints exactly what cat already showed. The real trap is assuming it is binary at all. The description says the flag is in the clear, so cat is enough and no extraction tool is needed.

    Tried: Open the downloaded file in a hex editor looking for encoded or obfuscated content.

    A hex editor shows raw bytes, which for a plain ASCII file just mirrors what cat displayed. Nothing is encoded or hidden in the byte stream. The title is literal: there is no steganography, encoding, or obfuscation to reverse.

    Learn more

    The challenge title is a reference to the cryptographic concept of "nothing-up-my-sleeve numbers" - constants chosen in a transparent way to assure users that no hidden backdoors or biases were built in. Here it is used literally: there is genuinely nothing hidden. The flag is sitting in the file as readable text.

    wget downloads a file from a URL and saves it to disk. curl -O is an equivalent alternative. After saving, cat prints the file contents to the terminal. These two commands are the entire solution.

    This style of challenge is sometimes called a "sanity check" - it verifies that you can connect to the challenge server and run basic command-line tools, rather than testing a specific vulnerability class.

Interactive tools
  • Regex TesterTest regular expressions against a string with live match highlighting, flag toggles, and common CTF pattern shortcuts.
  • Strings ExtractorPull printable text from any binary, library, or image. ASCII and UTF-16 detection, configurable minimum length, flag-like highlight, no command line needed.
  • File Magic IdentifierIdentify file types from magic numbers. Paste hex bytes or drop a file to detect PNG, JPEG, ZIP, PDF, ELF, PCAP, SQLite, and dozens of other formats.

Flag

Reveal flag

picoCTF{...}

The flag is stored in plaintext in the downloaded file - no decoding or extra tools required.

Key takeaway

Plaintext files served over HTTP expose their full contents to anyone who can reach the URL, with no authentication or encryption in the way. wget and curl fetch remote files from the command line, and cat prints any text file straight to the terminal. In CTFs and real audits alike, check whether the data is protected at all before assuming a complex vulnerability is needed.

Related reading

Useful tools for General Skills

Where to go next

Try these next