Canvas
Personal Rating: Easy
This challenge was a lot of fun for me. We have the source of a webpage.
In the index.html we can see that login.js is called:
<html>
<head>
<title>canvas</title>
<link rel="stylesheet" href="css/style.css"/>
<script src="js/login.js"></script>
</head>
<body>
<div class="container">
<div class="main">
<h2>Canvas login</h2>
<form id="form_id" method="post" name="myform">
<label>User Name :</label>
<input type="text" name="username" id="username"/>
<label>Password :</label>
<input type="password" name="password" id="password"/>
<input type="button" value="Login" id="submit" onclick="validate()"/>
</form>
</div>
</div>
</body>
</html>The login.js was a very obfuscated javascript:
I used jq to beautify the code, renamed variables and decoded strings etc. until I found an interesting function and array that I thought was likely the flag:
Decoding the 'res' array, I got the flag.
Last updated