Skip to main content

Scavenger Hunt

🔎 Solution​

By inspecting the website's source code, we immediately notice a small comment revealing the first part of the flag.

<!-- Here's the first part of the flag: picoCTF{t -->

Additionally, within the <head> section, we see links to two files: mycss.css and myjs.js.

Upon checking the contents of mycss.css, we find another small comment, which contains the second part of the flag.

/* CSS makes the page look nice, and yes, it also has part of the flag. Here's part 2: h4ts_4_l0 */

Moving on to myjs.js, there's a comment that reads: How can I keep Google from indexing my website? A quick search online reveals that one common way to prevent search engines from indexing a site is by using a robots.txt file. This file, placed in the root directory of a website, provides directives to web crawlers about which parts of the site should not be indexed. Navigating to /robots.txt, we uncover the third part of the flag, along with a hint pointing toward something related to Apache and "access".

User-agent: *
Disallow: /index.html
# Part 3: t_0f_pl4c
# I think this is an apache server... can you Access the next flag?

Knowing that Apache servers often use a .htaccess file for configuration purposes - such as setting URL rewrite rules, restricting access, or customizing error pages, we visit /.htaccess. Here, we find the fourth piece of the flag and another clue involving Mac and the term "store".

# Part 4: 3s_2_lO0k
# I love making websites on my Mac, I can Store a lot of information there.

This leads us to .DS_Store, a file automatically generated by macOS in directories to store folder view settings and custom attributes. Despite being hidden by default, this file can sometimes unintentionally be uploaded along with website files. Accessing /.DS_Store (note the case sensitivity), we retrieve the final piece of the flag.

Congrats! You completed the scavenger hunt. Part 5: _a69684fd}

Combining all the fragments gathered from the various hidden comments and configuration files, we successfully assemble the full flag.

🚩Flag​

picoCTF{th4ts_4_l0t_0f_pl4c3s_2_lO0k_a69684fd}