Description
Another static page hides information across the files it includes. Inspect each asset referenced in DevTools to stitch together the full flag.
Setup
Open the site in your browser and launch the developer tools (F12).
Look under the Sources tab to view index.html, script.js, and style.css.
Each static file reveals part of the flag; concatenate them in order.
Solution
- Step 1Collect the CSS portionstyle.css contains the first half of the flag inside a comment.
- Step 2Collect the JS portionscript.js holds the remaining characters. Join the two strings to form the full picoCTF flag.
Flag
picoCTF{1nclu51v17y_1of2_f7w_2of2_6ede...}
Anything sent to the client can be recovered-never trust obscurity inside frontend assets.