c4ptur3-th3-fl4g

Files Provided

Tools Used:

Environment:

The room was divided into four sections: Translation & Shifting, Spectrograms, Steganography, and Security through Obscurity. The latter three sections each had downloadable files to analyse.

Section One — Translation & Shifting

Task 1: c4n y0u c4p7u23 7h3 f149?

This is leet speak — a substitution system where numbers replace visually similar letters (4→a, 0→o, 7→t, etc.). Translating it directly gives:

Flag: can you capture the flag

Task 2:

Eight-bit groups of 0s and 1s indicate binary encoding. Decoded via CyberChef's "From Binary" recipe:

Flag: lets try some binary out!

Task 3: MJQXGZJTGIQGS4ZAON2XAZLSEBRW63LNN5XCA2LOEBBVIRRHOM======

The trailing ====== padding and uppercase alphanumeric characters identify this as Base32. Decoded with CyberChef:

Flag: base32 is super common in CTF's

Task 4: RWFjaCBCYXNlNjQgZGlnaXQgcmVwcmVzZW50cyBleGFjdGx5IDYgYml0cyBvZiBkYXRhLg==

The == padding and mixed-case alphanumeric characters identify this as Base64. Decoded with CyberChef:

Flag: Each Base64 digit represents exactly 6 bits of data.

Task 5: 68 65 78 61 64 65 63 69 6d 61 6c 20 6f 72 20 62 61 73 65 31 36 3f

Space-separated two-character groups in the range 0–9 and a–f identify this as hexadecimal. Decoded via CyberChef's "From Hex" recipe:

Flag: hexadecimal or base16?

Task 6: Ebgngr zr 13 cynprf!

The mention of "13" is a direct hint at ROT13, a Caesar cipher with a shift of 13. Applied via CyberChef:

Flag: Rotate me 13 places!

Task 7: @F DA:? >6 C:89E C@F?5 323J C:89E C@F?5 Wcf E:>6DX

The @ and other non-alphabetic substitutions point to ROT47, which operates across a wider ASCII range than ROT13. Applied via CyberChef:

Flag: You spin me right round baby right round (47 times)

Task 8:

Standard Morse code. Decoded via CyberChef's "From Morse Code" recipe:

Flag: telecommunication encoding

Task 9: 85 110 112 97 99 107 32 116 104 105 115 32 66 67 68

Space-separated decimal values in the ASCII range. Converting each to its ASCII character via CyberChef:

Flag: Unpack this BCD

Task 10:

This required multiple decoding steps in CyberChef: Base64 → Morse code → further decoding. The final decoded message:

Flag: Let's make this a bit trickier…

Section Two — Spectrograms

A spectrogram is a visual representation of the frequency spectrum of an audio signal over time. Text can be embedded into audio by encoding it as visible patterns in the spectrogram.

I opened the provided secretaudio.wav file in Sonic Visualiser, then selected Layer → Add Spectrogram. Zooming in on the waveform revealed text embedded in the frequency data:

Flag: Super Secret Message

Section Three — Steganography

The provided image appeared to be a photo of a seal with spaghetti. I used Steghide to attempt extraction with a blank passphrase:

This extracted a hidden text file containing:

Flag: SpaghettiSteg

Section Four — Security through Obscurity

Security through obscurity relies on hiding information by concealing the design or implementation details of a system. This task demonstrated one of its weaknesses — data can sometimes be found without proper credentials simply by inspecting files carefully.

Running cat on the provided image file revealed readable strings appended beyond the normal image data:

Inspecting the output showed an embedded archive structure. The archive contained a file named hackerchat.png, and within it, a hidden string:

Question 1 — First filename: hackerchat.png

Question 2 — Hidden text: AHH_YOU_FOUND_ME!