174 words
1 minute
WebDecode - picoCTF Writeup

This challenge is a simple reminder that web challenges often hide useful clues in places users do not normally inspect. The page encourages us to search around the site and pay attention to the content.

Hint found in about page

While browsing the pages, the about section contains a strong hint telling us to inspect the page. That usually means the solution is hidden in the HTML source rather than in visible content.

Inspecting the page source

After viewing the source code, we find an encoded-looking string:

Encoded Base64 string in source code

The value has the typical shape of Base64 data, so the next step is to decode it. If you want to verify that assumption manually, you can also test it with any Base64 decoder.

Base64 validation step

On the command line, decoding it is straightforward:

Terminal window
echo "cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRfMjgzZTYyZmV9" | base64 -d

Decoded flag output

The decoded output gives the flag directly. Technically, the challenge is very simple, but it teaches an important habit: always inspect HTML source, comments, and encoded strings before assuming a web challenge is more complex than it really is.