j4v45CR1Pt 08fu5c4t0r

Full solution below. Spoilers ahead.

Task description

Ema wasn’t happy with her Python program, so this time she made a website. As before, the password it accepts is a combination of her favourite numbers.

The original was in Croatian; this is my translation.

Obfuscated, not hidden

The page is a password form. Its check runs in JavaScript in your browser, which (as in The Most Secure Password Check) means the code is yours to read. Opening the developer tools (right-click, Inspect) showed a script, but it was obfuscated: deliberately rewritten into tangled, unreadable code, with every value fetched through a scrambling function so nothing reads plainly.

First we ran it through a beautifier (beautifier.io), which reformats cramped code into a readable layout. The heart of it was this:

function checkPassword() {
    var expected = _0x15f39c(486, "]H58");
    document[...](...)[...] == expected ? alert(...) : alert(...);
}

It builds the expected password into a variable, then compares what you typed against it.

Printing the answer

Obfuscation makes code hard to read, but the code still has to produce the real password to do its comparison, and it does that in your browser. So instead of untangling the scrambling function by hand, we just asked the page to print the value it builds. We added one line:

function checkPassword() {
    var expected = _0x15f39c(486, "]H58");
    console.log(expected);   // print the correct password
    // ...the rest unchanged
}

We pasted the beautified script into a copy of the page, opened the console (the developer tools’ tab for running JavaScript and seeing output), and called checkPassword(). It printed the expected password, which was the flag.

The lesson is the same as the client-side password task: code that runs in the browser can’t keep a secret from the person running it, and obfuscation only slows down reading it, since the real value still has to appear at runtime.