CRTP Giveway CTF [Walkthrough]

Created by Florian Schüssler

The challenge was simple — Collect 7 flags to enter the giveaway for the Certified Red Team Professional (CRTP) certification from Altered Security.

The puzzles were short, fun, and honestly a great warm-up for real-world vulnerabilities from the OWASP Top 10 (2025).

Here’s my journey — Let’s go. 👇

This is the main page : CTF Home Page

Challenge 1 — Hidden Comment (OWASP A06: Insecure Design)

I opened the page. Looked normal.

But as always, I checked View Page Source — and boom:

RkxBR3tBRTZEQkI0MDY4NzAyQX0=

The flag was stored directly inside HTML comments in Base64 encoded, which is easily viewable by anyone inspecting the source.

So i decoded it — FLAG unlocked instantly.

Challenge 2 — Developer Hint Exposure (OWASP A06: Insecure Design)

At this stage, I checked the page source first but got nothing important. then i inspect the page and found this sensitive output was left inside DevTools console hints. Any sensitive debugging information exposed at client-side is a leak.

}1CA27F9A4C8A64{GALF

I Just simply written it backwards.

Got the FLAG. Easy win.

Challenge 3 — (The One I Skipped)

I used curl and noticed the X-Debug-Note header in the HTTP response. From there, I obtained the flag. Unfortunately, I didn’t take a screenshot.

Challenge 4 — Unprotected Endpoint (OWASP A02: Security Misconfiguration)

In the source code, I found this JavaScript snippet:

I modified the url and tried loading it directly: https://cyber-giveaway.online/ch4_flag

BOOM again:

Anyone who reviews the JS or manually opens the URL gets the flag. (No Authorization check). This is why exposed endpoints are dangerous in production.

Challenge 5 — Local File Inclusion (OWASP A05: Injection)

The page allows to load: challenge5?file=index.html

So, this smells like a Local File Inclusion (LFI) challenge. That means, I can try to load other files on the server, especially the flag file right!

I replaced the file name with: ?file=flag.txt

And yes… the server happily loaded the flag.

A classic LFI — simple but effective

Challenge 6 — IDOR (OWASP A01: Broken Access Control)

The URL structure : ?note=1

I tried changing the note number.

?note=2 → Maintenance note: Internal checks ?note=3 → Dev note: Minor refactoring ?note=4 → Note not found

Then…

?note=7

And yes — the flag appeared.

Classic IDOR challanege. Users can view internal notes simply by changing the ID number. No access control, no authentication, nothing.

Challenge 7 — JWT Forgery (OWASP A08: Software/Data Integrity Failures)

Inside the HTML source, they literally leaked this:

S0VZXzEwYTI2YjY1

This is a Base64 encoding. I decoded it and got this:

KEY_10a26b65

You could forge an admin token using HS256 + leaked key.

JWT relies on strong, private signing keys. And. here the key was exposed client-side, and also too weak. This allowed forging a valid admin token.

Then i go to my favourite website: JSON Web Tokens and decode the jwt given by the challenge.

I copied the header and and payload. But, this is the guest payload, so i need to create an admin payload.

For creating that, I need iat (issued at timestamps). To get the correct iat, I inspect DevTools and go to console and type allow first, then typed this:

Math.floor(Date.now() / 1000)

In return i got the iat value = 1763905185

Now time to encode it and rebuilt the payload for getting the admin JWT

After generating this valid admin JWT, I copied it and paste it to the challenge box, and got the FLAG.

Felt like a real hacker moment xD

Profile Submission

After completing all the challenges I had to submit my linkedin URL as instructed:

Huge respect to Florian Schüssler for designing such a clean, enjoyable mini-CTF. Original giveaway post: Click Here

A great experience. Really enjoyed every bit of it.