credstuff

Description

Solution

1. Step 1Map the username
   `grep -n "cultiris" usernames.txt` reveals the account sits at line 378. Because both files are aligned, that same line number in `passwords.txt` holds the encrypted secret.
   Learn more

   Credential dumps(also called "combo lists") are leaked databases of usernames and passwords, often from breached websites. They frequently appear as paired text files where every line in one file corresponds to the same-numbered line in the other - a simple format that makes bulk password-spraying easy for attackers.

   The grep -n flag prints line numbers alongside matches, which is the key to linking the two files. Without -nyou would see the username but not know which line to look up in the password file. This "join by line number" pattern also appears in log analysis and data correlation tasks.

   In real incident response, tools like paste or Python's zip() are used to merge parallel files so each row contains both the username and password together - making it much easier to search for a specific user and immediately see their credential.

2. Step 2Retrieve the password entry
   `sed -n '378p' passwords.txt` prints `cvpbPGS{P7e1S_54I35_71Z3}`, an obvious substitution that still resembles the picoCTF format.
   Learn more

   ROT13 is immediately recognizable here because the encoded text still has the structure of the flag format - cvpbPGS is clearly picoCTF shifted by 13. This visual pattern recognition is a useful skill: once you know what the plaintext prefix should look like, you can identify the cipher (or encoding) just by counting the letter shift.

   sed -n 'Np' is the canonical shell way to print exactly one line from a file by number. Alternatives include awk 'NR==N' or head -N file | tail -1, but the sed form is the most concise.

3. Step 3Apply ROT13
   Running the line through `caesar 13` (from bsdgames) or any ROT13 decoder transforms it back into plaintext, yielding the final flag.
   Learn more

   ROT13 is a Caesar cipher with a fixed shift of 13. Because the English alphabet has 26 letters, applying ROT13 twice returns the original text - it is its own inverse. This makes it trivially reversible, which is why it was never meant for security; historically it was used on Usenet to hide spoilers or mildly offensive content from casual readers.

   On Linux, caesar 13 (from the bsdgames package) applies the shift. Other quick methods include tr 'A-Za-z' 'N-ZA-Mn-za-m', Python's codecs.encode(s, 'rot_13'), or any of dozens of online ROT13 tools. The cipher appears frequently in CTFs as a trivial encoding layer or as part of a multi-layer challenge.

   In the context of credential dumps, storing passwords in ROT13 is essentially the same as storing them in plaintext - it provides zero security. This challenge highlights why even simple obfuscation is meaningless without real cryptographic hashing (bcrypt, scrypt, Argon2) when storing passwords.

Alternate Solution

Flag

picoCTF{...}

Because the files are line-aligned, finding the username index immediately pinpoints the paired password.