WATKORN.ME https://watkorn.me/ CTF writeups, security notes and tools by watkorn. en Writeup: the watkorn.me mini CTF https://watkorn.me/blogs/mini-ctf-writeup/ https://watkorn.me/blogs/mini-ctf-writeup/ Sat, 26 Sep 2026 00:00:00 GMT Full solutions for all five flags hidden on this site: dotfiles, view-source, robots.txt and a yeti with a secret. Spoilers, obviously. ctf writeup beginner

Spoiler alert. This post solves every level of the mini CTF on this site. If you haven't tried it yet, go to the home page, type ls, and come back when you're stuck. Hints are free on the achievements page. The flags themselves are folded away below each level, so you can read the method without seeing the answer.

The mini CTF has five levels, worth 10 to 50 points (150 in total). The terminal checks your answers with submit <flag>, and it only knows the SHA-256 hashes of the flags, so the answers aren't sitting in the JavaScript in plain text. Well, mostly. Let's go.

Level 1: Warm-up (10 pts)

"Some files are just lying around in the home folder."

The classic first move in any shell is to look around:

watkorn@me:~$ ls
flag.txt  README.md
watkorn@me:~$ cat flag.txt

That's it. The warm-up is literally a file called flag.txt. There's also a sneaky second path: echo with the word "flag" in it prints the flag too.

Show flag

my_w3b_is_c00ler_th4n_u_th1nk

Lesson: always enumerate before you get clever. ls, cat, file, strings.

Level 2: Hidden in plain sight (20 pts)

"ls shows files. ls -la shows all of them."

On Linux, files starting with a dot are hidden from a plain ls. Add -a (all) and -l (long):

watkorn@me:~$ ls -la
drwxr-xr-x 3 watkorn users 4096 Oct 8 2025 .
drwxr-xr-x 3 watkorn users 4096 Oct 8 2025 ..
drwx------ 2 watkorn users 4096 Oct 8 2025 .secret
-rw-r--r-- 1 watkorn users   67 Oct 8 2025 flag.txt
-rw-r--r-- 1 watkorn users  123 Oct 8 2025 README.md
watkorn@me:~$ cd .secret
watkorn@me:~/.secret$ cat note.b64
d2F0a29ybntkMHRmMWwzc180cjNfbjB0X3MzY3IzdHN9

The .b64 extension gives it away: letters, digits and a length that's a multiple of 4 all scream Base64. Decode it anywhere except the site's terminal:

echo 'd2F0a29ybntkMHRmMWwzc180cjNfbjB0X3MzY3IzdHN9' | base64 -d

Or use CyberChef with the "From Base64" operation.

Show flag

watkorn{d0tf1l3s_4r3_n0t_s3cr3ts}

Lesson: Base64 is encoding, not encryption. Anyone can reverse it, no key needed. And "hidden" dotfiles hide nothing from someone who types -a.

Level 3: View source (30 pts)

"The page you see isn't the whole page."

What the browser renders is only part of what the server sends. Open the raw HTML with Ctrl+U (or view-source:https://watkorn.me/), or fetch it:

curl -s https://watkorn.me/ | grep -i "note to self"

Near the top of <body> there's an HTML comment:

<!-- note to self (level 3): jngxbea{i13j_f0hep3_o3s0e3_l0h_u4px}  ·  rot13, obviously -->

It even tells you the cipher. ROT13 shifts every letter 13 places, and applying it twice gets you back where you started:

echo 'jngxbea{i13j_f0hep3_o3s0e3_l0h_u4px}' | tr 'A-Za-z' 'N-ZA-Mn-za-m'

Digits and symbols are left alone, which is why {, _ and the leetspeak numbers survive untouched.

Show flag

watkorn{v13w_s0urc3_b3f0r3_y0u_h4ck}

Lesson: comments ship to production more often than you'd think. On real web challenges (and real bug bounties), read the source, the JavaScript bundles and the HTML comments first.

Level 4: Robots only (40 pts)

"Every well-behaved crawler reads one file before anything else. Be badly behaved."

That file is /robots.txt, a polite request to search engines about what not to index:

curl -s https://watkorn.me/robots.txt

User-agent: *
Disallow: /y3t1-l41r/

"Please don't look at /y3t1-l41r/" is basically an invitation. Visit the yeti's lair and you'll find a wall of bytes: 77 61 74 6b 6f 72 6e 7b …. That's hex: every pair of characters is one byte, and 77 61 74 is wat. Convert it back:

echo '77 61 74 6b 6f 72 6e 7b 72 30 62 30 74 73 5f 74 78 74 5f 31 73 5f 34 5f 74 72 33 34 73 75 72 33 5f 6d 34 70 7d' | xxd -r -p

No xxd? Python works anywhere (and CyberChef's "From Hex" does too):

python3 -c "print(bytes.fromhex('77 61 74 6b 6f 72 6e 7b 72 30 62 30 74 73 5f 74 78 74 5f 31 73 5f 34 5f 74 72 33 34 73 75 72 33 5f 6d 34 70 7d').decode())"
Show flag

watkorn{r0b0ts_txt_1s_4_tr34sur3_m4p}

Lesson: robots.txt is not access control. It lists exactly the paths someone wanted to hide, which makes it one of the first files to check in any web challenge or recon.

Level 5: Pixel secrets (50 pts)

"The yeti is an SVG. Open the file on its own and look past the pixels."

The pixel yeti isn't an image tag; it's drawn from an SVG sprite. In DevTools (F12 → Elements), inspect the yeti and you'll find something like:

<use href="/assets/yeti-XXXXXXXX.svg#yeti"></use>

(the part after yeti- is a content hash, so yours may differ). Open that SVG file directly in a new tab and view its source. SVG is just XML, and next to the drawing there's a <metadata> element the browser never renders:

<metadata>yeti-says: d2F0a29ybntwMXgzbHNfYzRuX2gxZDNfc3Q0ZmZfdDAwfQ==</metadata>

The == padding at the end is a Base64 tell, again:

echo 'd2F0a29ybntwMXgzbHNfYzRuX2gxZDNfc3Q0ZmZfdDAwfQ==' | base64 -d

Command-line route, no DevTools needed:

js=$(curl -s https://watkorn.me/ | grep -o '/assets/index-[^"]*\.js')
svg=$(curl -s "https://watkorn.me$js" | grep -o '/assets/yeti-[^"`]*\.svg' | head -1)
curl -s "https://watkorn.me$svg" | grep -o 'yeti-says: [^<]*'
Show flag

watkorn{p1x3ls_c4n_h1d3_st4ff_t00}

Lesson: images can carry data. SVGs are text files that can hold metadata, comments and even scripts. That's why real sites sanitise user-uploaded SVGs, and why steganography challenges love image files.

How the checking works (and its limits)

  • The terminal hashes whatever you submit with SHA-256 in your browser (crypto.subtle.digest) and compares it against the five stored hashes. The hashes are public, but a hash can't be reversed back into the flag.
  • Your progress is stored in your browser's localStorage. Nothing is sent to a server, because there isn't one.
  • Honest limits: flags 1 and 2 have to live in the JavaScript, because the terminal prints them. And the whole site is open source, so reading the repo is a valid, if slightly cheeky, strategy. For a warm-up CTF, that's a feature.

What this mini CTF teaches

Level Technique Real-world version
1 Enumerate first ls, strings, reading every file you're given
2 Hidden files + Base64 dotfiles, .git/, encoded config values
3 View source + ROT13 leaked comments, secrets in JS bundles
4 robots.txt + hex recon on robots.txt, sitemap.xml, .well-known/
5 File metadata EXIF data, SVG/Office metadata, steganography

Got all five? Screenshot your achievements and tag me. Next time I'll make them harder.

]]> Preparing for CTF https://watkorn.me/blogs/preparing-for-ctf/ https://watkorn.me/blogs/preparing-for-ctf/ Wed, 08 Oct 2025 00:00:00 GMT A no-fluff starter kit for your first Capture The Flag: pick a category, set up your tools, practise, and survive the weekend. ctf beginner Capture The Flag (CTF) competitions are the most fun way to learn security. Someone hides a string like flag{...} behind a broken web app, a weird binary or a suspicious PCAP, and you break things (legally) until it falls out. You'll fail a lot at first. That's the whole point.

This is the guide I wish I'd had before my first one.

CTFtime, where you find upcoming CTFs

First, what kind of CTF is it?

  • Jeopardy. A board of challenges by category and points. Solve any in any order. This is 90% of CTFs and where you should start.
  • Attack–Defense. Every team gets the same vulnerable services. Patch yours, exploit everyone else's. Chaotic, amazing, not for week one.
  • King of the Hill. Take over a box and hold it. Great on TryHackMe once you're comfortable.

Find events on CTFtime. Look for ones tagged beginner, or with low "weight".

Pick a lane (then another)

Nobody is good at everything. Start with one or two categories, then branch out.

Category What it is Learn first
web Break web apps HTTP, cookies, SQLi, XSS, SSTI, IDOR, reading JS
pwn Exploit binaries for a shell C, stack layout, buffer overflows, ROP, checksec
rev Figure out what a program does x86-64 basics, Ghidra, strace/ltrace, patching
crypto Break bad cryptography XOR, RSA mistakes, padding, encodings vs encryption
forensics Dig through files, memory, traffic file formats, Wireshark, Volatility, steganography
misc / OSINT Everything else Linux-fu, scripting, search skills

If you don't know where to start: web or forensics. You get quick wins without needing assembly first.

Set up your toolkit

A Linux VM (Kali, Parrot or plain Ubuntu) keeps everything in one place and your host clean. Core tools:

  • Everywhere: Python 3, CyberChef, file, strings, a good text editor
  • Web: Burp Suite Community, browser DevTools, ffuf, curl
  • Pwn / rev: pwntools, GDB + pwndbg or GEF, Ghidra, checksec
  • Forensics: Wireshark, binwalk, exiftool, Volatility 3
  • Crypto / cracking: hashcat, John the Ripper, SageMath or plain Python
sudo apt install -y python3-pip gdb binwalk exiftool wireshark john hashcat
pip install pwntools
git clone https://github.com/pwndbg/pwndbg && cd pwndbg && ./setup.sh

Practise before the weekend

  • picoCTF: the best place to start. Challenges go from gentle to genuinely hard.
  • OverTheWire: Bandit: Linux basics, one level at a time.
  • TryHackMe: guided rooms and learning paths.
  • Hack The Box: realistic machines, plus a "Challenges" section in CTF style.
  • pwn.college: the free university course for pwn and rev.
  • CryptoHack: crypto, taught through puzzles.

Aim for something small every day rather than one huge weekend. Ten solved easy challenges beat one hard one you gave up on.

The first 10 minutes of any challenge

Before anything clever, run the boring stuff. It solves more challenges than you'd think.

file chall                      # what is this, really?
strings -n 8 chall | less       # readable text, sometimes the flag itself
exiftool image.png              # metadata
binwalk -e firmware.bin         # files hidden inside files
checksec --file=./chall         # which protections does this binary have?

For web challenges: read the page source, open DevTools, check /robots.txt, look at cookies, and watch every request in Burp.

During the CTF

  • Read every challenge first. Sort by number of solves; the most-solved ones are usually the easiest.
  • Timebox. If you've made no progress in 45–60 minutes, switch challenges and come back later.
  • Write everything down. What you tried, what failed, and every weird thing you noticed. Future-you will thank you.
  • Read the rules. Don't attack the infrastructure, don't brute-force the flag submission, don't share flags.
  • Sleep and eat. Seriously. Tired brains don't find off-by-one bugs.

Play with a team

  • One channel or thread per challenge. Post what you've tried.
  • "Claim" a challenge so two people don't silently do the same thing.
  • Share notes in one place (Obsidian, HedgeDoc or Notion) so nothing lives only in your head.
  • Pair up: someone strong in rev plus someone strong in pwn is a very good combo.

After the CTF (the part everyone skips)

This is where most of the learning actually happens:

  1. Read other teams' writeups for the challenges you didn't solve. CTFtime links them on each event page.
  2. Write your own writeups, even for easy ones. Explaining a solve is how it sticks. (On this site, it's npm run new-post -- --writeup "Challenge name".)
  3. Turn repeated tricks into cheat sheets. Payloads, one-liners, Python snippets.

Quick checklist

Want a warm-up right now? The terminal on the home page has five flags hidden around this site. Check your progress on the achievements page. Good luck, and have fun breaking things.

]]>