Crack the Gate 1 picoMini by CMU-Africa Solution

Description

1. Step 1Find and decode the hidden comment

   Observation

   The HTML source holds a comment full of garbled text that still keeps its word boundaries and letter frequency. Those are ROT13 hallmarks, so decoding it should reveal a developer note.

   View the page source and locate the ROT13-encoded HTML comment. Decode it with tr or an online ROT13 tool. The comment reveals a custom HTTP header that bypasses authentication.

   bash

   echo 'ABGR: Wnpx - grzcbenel olcnff: hfr urnqre K-Qri-Npprff: lrf' | tr 'A-Za-z' 'N-ZA-Mn-za-m'

   Copied!

   Expected output

   NOTE: Jack - temporary bypass: use header X-Dev-Access: yes

   What didn't work first

   Tried: Try decoding the comment with base64 instead of ROT13.

   Piping the text through base64 -d throws an invalid character error, because ROT13 output is not valid base64. The giveaway is that the ciphertext keeps its word boundaries and English letter frequency, where base64 produces a dense run of mixed alphanumerics with no spaces.

   Tried: Copy the encoded comment and paste it into a Caesar cipher brute-forcer trying all 25 shifts.

   Most Caesar brute-force tools dump all 25 shifts and leave you to spot the right one, which works but is slower than going straight to shift 13. Worse, some handle only one letter case and silently drop the other, mangling the output and hiding the phrase you want.

   Learn more

   ROT13 (rotate 13) is a simple substitution cipher that shifts each letter forward 13 positions in the alphabet. Because the alphabet has 26 letters, applying ROT13 twice returns the original text - encoding and decoding use the same operation. It is not a security mechanism; it is used to obscure text from casual reading (like spoiler tags on forums).

   HTML comments (<!-- ... -->) are sent to every browser that requests the page - they are visible to anyone who uses "View Source" or browser developer tools. Developers sometimes leave backdoor notes, API keys, internal URLs, or debug instructions in comments, assuming they are invisible because they don't render visually. This is a very common finding in bug bounty hunting.

   The tr command translates (replaces) characters. The pattern tr 'A-Za-z' 'N-ZA-Mn-za-m' maps each letter to its ROT13 equivalent - A becomes N, B becomes O, and so on, wrapping around at Z. This is a standard one-liner for quick ROT13 decoding in the terminal.

2. Step 2Send the login request with the bypass header

   Observation

   The decoded comment names a custom header, X-Dev-Access: yes, as a temporary bypass. So send a POST login request with that header added via curl and skip authentication entirely.

   The decoded message says to include the header 'X-Dev-Access: yes'. Send the login POST request with this header added - authentication is bypassed and the flag is returned.

   bash

   curl -X POST https://<host>/login -H 'X-Dev-Access: yes' -d 'email=ctf-player@picoctf.org&password=anything'

   Copied!

   What didn't work first

   Tried: Try sending the bypass header as a GET request instead of POST.

   A GET to /login usually returns the login form rather than processing credentials, so the server ignores the bypass header and no flag comes back. The decoded comment describes a login action, which is the POST that submits the form.

   Tried: Add the custom header using browser developer tools Network tab instead of curl.

   Chrome's Network tab has no header editor; the closest it offers is 'Copy as cURL', which just hands the request back to the terminal anyway. Firefox's 'Edit and Resend' does let you add a header, and a same-origin fetch() from the console works too, but a plain HTML form submission never sends a custom header no matter what you click. Use curl, or a proxy like Burp Suite, where you control every header sent.

   Learn more

   Custom HTTP headers like X-Dev-Access are non-standard headers that applications sometimes use for internal communication, feature flags, or - as in this case - poorly implemented developer shortcuts. HTTP headers can be set to any arbitrary value by the client, so any authentication logic that trusts a client-supplied header without cryptographic verification is bypassed trivially.

   This class of vulnerability appears in real-world applications as "debug modes," "admin bypass headers," or internal IP allowlisting that trusts X-Forwarded-For. The lesson is that the server can never trust any input from the client - headers, cookies, POST body, and URL parameters are all fully controlled by the person making the request.

   curl -H adds a custom header to the request. -X POST changes the HTTP method, and -d sends URL-encoded form data in the request body. These three flags together replicate what a browser sends when you click a login button, while adding the extra bypass header the server is secretly checking for.

Flag

Per-instance flag. The prefix picoCTF{brut4_f0rc4_ is consistent, while the hex suffix is issued per instance, so the tail returned by your own bypassed login request is yours alone.