Roboto Sans | picoCTF 2022 Solutions

Description

Inspect the site’s `/robots.txt`. The developer left Base64-encoded hints pointing to the real flag file.

Setup

Navigate to `/robots.txt`; it lists disallowed paths plus several Base64 strings.

Decode the strings (e.g., with CyberChef) to learn filenames like `flag1.txt` and `js/myfile.txt`.

Visit the decoded path `js/myfile.txt` to view the flag.

curl -s http://saturn.picoctf.net:55771/robots.txt

echo 'anMvbXlmaWxlLnR4dA==' | base64 -d # yields js/myfile.txt

curl -s http://saturn.picoctf.net:55771/js/myfile.txt

Step 1Read robots.txt
The file disallows `/cgi-bin/` and `/wp-admin/`, but more importantly includes encoded clues. Decoding them reveals exact file paths.
Step 2Grab the flag
Request `http://saturn.picoctf.net:55771/js/myfile.txt`. The response contains the picoCTF flag in plain text.

picoCTF{Who_D03sN7_L1k5_90B0T5_22ce...}

Robots.txt is frequently a gold mine for hidden endpoints during recon.