Two Layers, One Flag: Peeling Base64 then ROT13

Real obfuscation often stacks more than one transform, so peeling a value means working from the outside in, one layer at a time. The skill is reading each layer's format to decide which button to press next, rather than guessing. This challenge wraps a flag in two layers: base64 on the outside and ROT13 on the inside.

The outer layer is base64. base64 strings use upper and lower case letters and digits, and the lengths here happen to come out even without visible = padding, which can happen when the data length is already a multiple that base64 fits cleanly. Decode it and you do not get readable words yet. You get a string whose flag shape is intact - the prefix, braces, and underscores are all in their normal places - but whose letters are clearly wrong, each shifted by a fixed amount. That structure-intact, letters-shifted pattern is the signature of ROT13.

Tap ROT13 on that intermediate string and the shift reverses, turning the scrambled letters back into plain words so the full flag reads cleanly. The order matters: base64 first because it is the outer wrapper, ROT13 second because it is the inner one. Neither step uses a key, so the two layers together still provide no secrecy - they only make you press two buttons instead of one. The hex, URL, and reverse buttons are decoys whose formats do not match the string at either stage.

• Stopping after one layer. The base64 output is still scrambled, so it is tempting to think you decoded wrong. Recognise the letter shift and peel the second layer.
• Decoding in the wrong order. ROT13 only works on the readable text inside, so base64 must come first to expose it.
• Re-applying a transform to its own output. base64-decoding twice or ROT13-ing twice undoes your progress. Apply each layer exactly once.
• Believing two layers means it is encrypted. Stacking keyless encodings adds clicks, not confidentiality.

The defensive takeaway is that layering encodings is not a security control, no matter how many layers there are. If a value must be confidential it needs real encryption with a managed secret key, or it should not be exposed at all. Treat any chain of base64, hex, ROT13, or URL layers as cosmetic packaging that any reviewer can peel.

• Never rely on stacked encodings to keep secrets such as tokens, passwords, or personal data private.
• Use authenticated encryption with a managed key when data genuinely needs confidentiality.
• When reviewing artifacts, peel every layer you find until you reach plain text and confirm nothing sensitive is sitting there.
• Remember that the number of encoding layers does not change the lack of a key - more layers is not more security.