Description
The chess bot relays evaluation updates over a WebSocket. Instead of playing perfectly, hijack the `sendMessage` helper in the browser console and feed the server ridiculous evaluation scores.
Setup
Open the site, inspect the page source, and note the embedded WebSocket client and `sendMessage` helper.
Use your browser’s dev tools console to call `sendMessage(...)` directly. No moves required.
Solution
- Step 1Trigger the mate branchSending `sendMessage("mate 1")` updates the chat to “drown in 1 moves,” proving the server accepts arbitrary client messages.
- Step 2Force a wild evalThe flag is awarded when the evaluation dips beyond -50,000. Send any value lower than that to convince the bot you’re crushing it.sendMessage("eval -1000000000")
- Step 3Grab the responseThe chat window immediately prints the picoCTF flag once the server sees your impossible evaluation score.
Flag
picoCTF{c1i3nt_s1d3_w3b_s0ck3t5_e5e7...}
Because the logic runs entirely in the client, you don't need chess knowledge; just forge the WebSocket message.