/tags/misc/Recent content in Misc onHugo -- gohugo.ioMon, 14 Jul 2025 18:27:16 +0100/post/l3ak-puzzle4/Mon, 14 Jul 2025 18:27:16 +0100/post/l3ak-puzzle4/Just when we thought we had the system figured out, the authors straight up yeeted the crutch from underneath us: the reference image. The url field in the API response was some nonesense that led nowhere. We were essentially flying blind. This challenge was a two-act play. First, solve a jigsaw puzzle with no picture on the box, that would award us with the source code for the platform. Second, use that source code to scout for a vulnerability that would yield us the flag./post/l3ak-puzzle3/Mon, 14 Jul 2025 17:55:16 +0100/post/l3ak-puzzle3/So, you saw how we handled the last puzzle. It was flashy, watching the browser solve itself was a neat party trick, but it’s hella inefficient. Relying on Selenium to brute-force the DOM with clicks felt like using a sledgehammer for brain surgery. For this next stage, the puzzles got harder and the timer got drastically shorter. It was time to evolve. As hinted before, we knew there was a backend API./post/l3ak-puzzle2/Mon, 14 Jul 2025 17:17:16 +0100/post/l3ak-puzzle2/This is the second challenge in a 5-part series involving solving a scrablmed image puzzles (10 of them in this case) in record time, for the most part. The first part is solvable manually, but this level increases the number of pieces and reduces the time limit for each puzzle, making atomation the clear path forward. Hint Discovery Initial analysis of the web page revealed hint. The <h1> element containing the puzzle’s title was also an <a> tag, linking to an external site (which is X, but not always).