Day 3 — ENIGMA TASK

Challenge

Lorenzo Bellini is an independent historian whose relentless pursuit of Ezio Auditore’s legacy uncovered forgotten manuscripts, private correspondence, and sensitive historical records believed to have been lost for centuries. Realizing the danger of his discovery, he concealed everything inside a private online archive.

The archive has not gone unnoticed. A disguised Templar agent has already discovered its existence and is searching for a way inside. It is only a matter of time before the archive is compromised.

As a member of the Brotherhood, your mission is clear: uncover the archive, outpace the Templars, and lock it down before its secrets fall into the wrong hands.

Challenge:U0VBUkNIIFRIRSBVU0VSTkFNRSBPTiBQT1BVTEFSIFNJVEVTIChUV0lUVEVSL1gsIEZBQ0VCT09LKQoKVVNFUk5BTUU6IGxvcmVuem8xNDc2ClBBU1NXT1JEOiBSZXF1aWVzY2F0ITE0NzY=

Flag Format: ⁠ ENIGMA{…} ⁠

What Tools Were Used?

• Browser Developer Tools (Inspect Element): To find hidden HTML comments and edit webpage elements.
• CyberChef: To decode Base64 strings.
• X (Twitter): To gather hints from social media posts.

What Was the Solution?

Initial Decoding:

Found a Base64 string on X, decoded it using CyberChef, and bypassed the decoy flag (ENIGMA{HAHA_fake_flag}).

Found the hidden Netlify URL in a reply thread and logged in with the archive’s credentials.

Inspected the page source code and found a hidden directory path: /terminal.

Visited /terminal, ran ls, and read clue.txt using the cat command.

Opened DevTools, found the element <div id="archive" data-site_status="unlocked">, and changed "unlocked" to **"locked"**. This unlocked the final flag: ENIGMA{Archive_Secured_Before_The_Templars}.

Session Feedback

• What went well: The story was highly engaging. Including fake flags was a great touch because it forced me to be precise and not just copy the first string I saw.
• Key takeaway: It showed exactly how editing a client-side state in the browser can change how a website functions.