Pachinko picoCTF 2025 Solution

Description

1. Step 1Submit circuits and watch the network panel

   Observation

   The description says to submit circuits until the curators acknowledge you, so the flag sits behind a probabilistic server-side condition. Automating the requests with curl beats clicking by hand.

   Open DevTools > Network before clicking anything (closing DevTools or refreshing wipes the panel). Each "Submit Circuit" click POSTs JSON; on the order of 1 in 100 to 1 in 1000 submissions returns the flag, so a curl loop with a few hundred iterations is faster than clicking. A failed POST returns a payload like {"result":"You missed!"}; a winning POST contains picoCTF{...}.

   bash

   # Capture headers from one real submit (DevTools > right-click > Copy > Copy as cURL),
   # then fire many requests with timeout + retry + explicit success check:
   for i in $(seq 1 500); do
     body=$(curl -s --max-time 5 --retry 2 -X POST https://<host>/submit \
       -H 'Content-Type: application/json' -d '{}')
     echo "$body" | grep -ao 'picoCTF{[^}]*}' && break
   done

   Copied!

   Expected output

   picoCTF{p4ch1nk0_f146_0n3_e947...}

   What didn't work first

   Tried: Open DevTools after submitting a few requests and look for the flag in the Network tab.

   The Network panel records only while it is open, so a submit that returned the flag before you opened DevTools is gone for good. Dock it before the first submit; opening it mid-session leaves every earlier response invisible.

   Tried: Run the curl loop without the grep check and inspect the output visually at the end.

   Hundreds of iterations means hundreds of lines, and the flag is easy to scroll past. The loop also runs on after the winning request. Pipe each response through a grep for the flag pattern and break on the match.

   Learn more

   Many web challenges implement probabilistic or counter-based reward logic server-side. The server may award a flag after a fixed number of submissions, at random with a certain probability, or when some hidden internal state is reached. Reading the server source (when available) lets you understand exactly which condition triggers the reward rather than clicking blindly.

   When source isn't available, browser DevTools are your best friend. The Network tab records every HTTP request and response, including the full JSON body. The capture is tab-scoped and tab-lifetime: closing DevTools clears the panel, refreshing the page clears it, and navigating away clears it. Keep DevTools docked open from the moment you start testing so nothing slips past.

   For challenges that require repeated interactions, curl in a shell loop is far faster than clicking manually. Always set --max-time per request and check the response body for an explicit success substring (here, picoCTF{) so the loop terminates as soon as a flag arrives instead of running to completion.

2. Step 2Replay from the console

   Observation

   The Network panel only records what happens while DevTools is open. If curl is unavailable, or the session already lives in the browser, a fetch loop pasted into the Console automates the submissions and keeps cookies and CSRF headers intact.

   If you want to keep clicking through the real UI but speed it up, paste a fetch loop into the DevTools Console. Use the same fetch shape DevTools shows under "Copy as fetch" so cookies and CSRF headers are preserved.

   js

   // In DevTools Console, after at least one real submit:
   for (let i = 0; i < 500; i++) {
     const r = await fetch('/submit', { method: 'POST' });
     const t = await r.text();
     if (t.includes('picoCTF{')) { console.log(t); break; }
   }

   Copied!

   What didn't work first

   Tried: Use fetch('/submit', { method: 'POST' }) without copying the real request shape from the Network panel first.

   If the app wants a CSRF token or a particular JSON body, a bare POST returns 400 or 403 instead of a game response. Right-click the real request in the Network panel and copy it as fetch to get the exact headers, body, and credentials mode.

   Tried: Run the console loop while DevTools is undocked in a separate window, then close DevTools to check the UI for the winning toast.

   Closing the DevTools window terminates the console execution context - the loop stops immediately and any in-flight fetch is abandoned. Keep DevTools docked or in a side-by-side pane so the console JavaScript context stays alive for the full loop duration.

   Learn more

   The browser Network panel (accessible via F12 or right-click then Inspect) is one of the most powerful tools in web security research. It captures all HTTP/HTTPS traffic between the browser and server, including request headers, cookies, request bodies, response status codes, response headers, and full response bodies, even for requests that completed instantly.

   Clicking on any entry in the Network panel reveals a detail view with tabs for Headers, Payload, Preview, Response, Timing, and (for WebSocket connections) Messages. The Response tab shows the raw server response, making it possible to recover flag strings from dynamically generated content that was only briefly visible in the UI.

   For automated analysis, tools like Burp Suite or mitmproxy act as intercepting proxies between your browser and the server, logging every exchange with search and filter capabilities. These are standard tools in web penetration testing and are particularly useful when the flag appears in a response header or a non-displayed JSON field rather than in visible page content.

3. Step 3Record flag one

   Observation

   The winning response carries the flag, and the UI shows it only as a brief toast. Copy it the moment it appears.

   Once the pop-up finally includes picoCTF{...}, copy that value. That's flag one for Pachinko. Flag two appears only in the follow-up challenge, Pachinko Revisited.

   Learn more

   Multi-flag challenges are common in CTF competitions and mirror real-world multi-stage attack chains. Each flag typically unlocks the next phase of investigation, ensuring players understand each concept before moving on. In Pachinko, flag one demonstrates understanding of web interactions and response monitoring, while the revisited challenge presumably requires deeper source analysis or a different exploit vector.

   Keeping detailed notes during CTF challenges is valuable practice - writing down every endpoint you discover, every unusual response, and every hypothesis you explore. Many experienced CTF players maintain a structured notes file per challenge, which helps consolidate what you learned and makes the solution reproducible later.

Flag

There's no trick. The site randomly decides when to hand you the flag, and keeping the browser devtools open prevents you from missing it.