One Tap of Base64: Reading a Scrambled Flag
O desafio
Alguém embaralhou um flag para que ele não chamasse atenção num arquivo. É apenas uma camada de base64, não um cadeado. Toque no botão de decodificação certo para lê-lo, depois envie o flag.
O que você vai aprender
- Recognise base64 by sight, especially the trailing = padding at the end of a string
- Decode a single base64 layer with one button and read the result
- Understand that scrambling text is not the same as protecting it
- See that encoding can be reversed by anyone with no key or password
- Rule out other decoder buttons by checking whether their format even fits the string
Habilidades testadas
Pré-requisitos
- Comfort reading short lines of plain text
- The idea that the same text can be written in more than one form
Como funciona
base64 is a way of writing any data using only a small set of plain letters, digits, and a couple of symbols. It exists so that bytes can pass safely through places that only expect ordinary text, such as an email body, a URL, or a config file. It is completely public and reversible: there is an agreed table that maps each chunk back to its original bytes, so anyone can turn base64 back into what it was with no secret at all.
That is the key point for security. Because there is no key, base64 hides nothing. A value written in base64 is, for practical purposes, in plain view - it only takes the right button. People sometimes scramble a value with base64 and feel it is now safe, but that feeling is false. Encrypting something means it cannot be read without a secret key; encoding something just changes how it is spelled.
You can usually spot base64 by sight. It uses upper and lower case letters, digits, and often ends with one or two = signs, which are padding the encoder adds so the length comes out even. The string in this hack ends with a single =, which is a strong sign that the outer wrapper is base64. The other decoder buttons (hex, URL, reverse) expect different shapes of input, so they do not apply here.
Erros comuns
- Thinking the flag is protected. A scrambled-looking value is not a locked value. With no key involved, base64 offers zero secrecy.
- Guessing buttons at random. Each decoder expects a certain shape of input. The trailing
=points to base64, so there is no need to try the others first. - Decoding twice. base64-decoding the already-readable flag a second time scrambles it again. Decode once, read the flag, stop.
- Submitting only the inside text. The flag includes its full HDNA wrapper and braces, so submit the whole thing as shown.
Como se proteger
The lesson for builders is to never rely on encoding to keep anything private. If a value is sensitive, it must be protected with real encryption that needs a managed secret key, or it should not be stored or logged at all. base64 in a file, a cookie, or a URL means "this is a transport format", not "this is secured".
- Keep secrets such as tokens, passwords, and personal data out of logs and URLs entirely.
- Use proper encryption with a managed key when data genuinely needs to stay confidential.
- Treat any base64, hex, or URL layer you find as cosmetic and decode it to confirm nothing sensitive is one click from plain text.
- Review your own files and responses by decoding every encoded value you see.