Unminify picoCTF 2024 Solution

Description

1. Step 1Inspect the DOM

   Observation

   The page says the HTML is squished, meaning minified. The flag is still there in plaintext; search DevTools for the picoCTF{ prefix.

   Open DevTools (F12), focus the Elements panel, and Ctrl+F for picoCTF. The matching node highlights and you can read the flag in place.

   Learn more

   Browser DevTools (opened with F12 or Ctrl+Shift+I) provide a live, structured view of the DOM that is far more readable than raw source. The Elements panel lets you navigate the full HTML tree, search for text, and inspect attributes - even in heavily minified pages where the source is a single long line.

   Minification compresses HTML, CSS, and JavaScript by removing whitespace, comments, and shortening variable names to reduce file size and improve load times. It is a performance optimization, not a security measure. The content is identical to the original - it is just harder to read at a glance. The browser's DevTools automatically parse and pretty-print minified code in the Elements panel.

   • Use Ctrl+F in the Elements panel to search for text like picoCTF across the entire DOM tree.
   • The Sources panel has a "Pretty print" button ({}) that reformats minified JS/CSS with proper indentation.
   • View Source (Ctrl+U) shows the raw HTML as served by the server, before JavaScript modifies the DOM.
2. Step 2One-liner option

   Observation

   The whole page is one long line, so reading it by eye is hopeless. Pipe curl into grep with a non-greedy character class and pull the flag out directly.

   curl -s fetches the page and grep -oE picks out only the flag substring. The character class [^}]+ matches any flag body up to the first closing brace.

   bash

   curl -s http://titan.picoctf.net:<PORT_FROM_INSTANCE>/ | grep -oE 'picoCTF\{[^}]+\}'

   Copied!

   Expected output

   picoCTF{pr3tty_c0d3_743...}

   What didn't work first

   Tried: Run curl without grep and scroll through the output hoping to spot the flag manually.

   Minification puts the whole page on one very long line, where a short flag is nearly invisible. grep -oE isolates the match instead of leaving you to scan thousands of characters of concatenated HTML.

   Tried: Use grep -o 'picoCTF{.*}' (greedy dot-star) instead of the [^}]+ character class.

   A greedy .* runs from the first picoCTF{ to the last closing brace on the line. Minified HTML is full of braces, from CSS rules and JS objects, so the match swallows far too much. The negated class stops at the first closing brace, which is where the flag ends.

   Learn more

   curl -s fetches a URL silently (no progress bar) and prints the response body to stdout. Piping through grep -oE 'picoCTF\{[^}]+\}' extracts only the matching portion using an extended regex (-E) and prints only the match (-o) rather than the whole line. The character class [^}]+ matches any character that is not a closing brace, so the pattern stops cleanly at the end of the flag.

   This pipeline approach is a fundamental CTF and security research skill. Instead of manually reading through thousands of bytes of minified HTML, you let regex do the work. The same pattern applies to searching server responses, log files, and API output for sensitive information during penetration tests.

   If your shell aliases grep to --color=always and a redirected file comes out garbled with escape codes, add --color=never; the default --color=auto already drops the ANSI sequences when the output is not a terminal. Real CTF flags are often embedded inside HTML attribute values or JavaScript strings, so a tighter regex is sometimes needed if multiple matches collide on one line.

Flag

Even minified HTML can't hide a plaintext flag.