h1-ctf: HackyHolidays 2020 Full Write-up: Information Disclosure of 12 Flags

Intro This is my report for the 2020 Hacky Holidays HackerOne CTF. I managed to find all 12 flags with the assistance of my little helper, Jake. He specialises in brute-forcing via a unique keyboard mashing technique: {F1134543} Anywho, let's get started... Flag 1: Robots The first one was a nice easy find as a result of some basic enumeration. Looking in /robots.txt, I immediately spotted the flag: User-agent: * Disallow: /s3cr3t-ar3a Flag: flag{48104912-28b0-494a-9995-a203d1e261e7} Flag: flag{48104912-28b0-494a-9995-a203d1e261e7} Flag 2: Moved The content of the robots.txt file also contained a clue about the second flag: Disallow: /s3cr3t-ar3a There was a /s3cr3t-ar3a page which the server requested spiders to avoid. Very suspect! The secret area consisted of a message telling me the page had moved. If I had hit "inspect element" and browsed the DOM I could have quite quickly spotted the flag. {F1134542} However... Unintended Solution I'm ashamed to say I went the much longer way around. I initially viewed the static source code of the page, and noticed that the jQuery library wasn't loaded from a CDN like everything else on the site. Viewing the file showed the version of jQuery: /*! jQuery v3.5.1 ... I downloaded the file and then grabbed the "real" jQuery v3.5.1. Diffing them showed an interesting anomaly in the CTF version of the file: {F1134541} Interesting! Piecing it together revealed the flag. At this point I realised I could have just inspected element and seen...