This challenge consists of a decision-based web game and the solution consists of inspecting the application code and network traffic using the browser developer tools to extract a secret parameter that reveals the flag.

Reconnaissance

• Open the page deployed by HackTheBox at http://94.237.48.12:49639 and you will find a decision-based game:

• Start the game and play through the available options to understand its basic behavior:

Behavior and flag

• You can see that the game advances if the answer is correct, so the next step is to inspect the application code from the browser developer tools¹:

• The code shows the correct answers, but it also performs an initial check where a "secret" option appears. Because of that, open the Network tab in the browser tools and inspect the options file²:

• Inside those options, the "secret" parameter is present, so copy it and send it through the game's terminal to obtain the flag:

Footnotes

1. In this case, using the browser debugger ↩

2. To do this, reload the page with the Network tab already open ↩