Vulnerability Overview
Sensitive data was embedded in the HTML source code inside a non-standard attribute, encoded with Base64. Like all client-side storage, HTML attributes are fully visible to any user who views the page source.
Discovery
Navigating through the site's pages and viewing source revealed a suspicious attribute on the About page:
<section class="about" notify_true="cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRfMDJjZGNiNTl9">The attribute notify_true serves no legitimate HTML purpose. Its value — a string of alphanumeric characters with no spaces — matched the Base64 character set. Decoding it directly produced the flag.
Encoding Recognition Cheatsheet
| Pattern | Encoding |
|---|---|
Ends with = or == | Base64 |
Only a-f and 0-9, even length | Hexadecimal |
| Letters shifted by 13 positions | ROT13 |
%3D, %2F, %20 | URL encoding |
Key Insight: The client side is the attacker's side. Every HTML attribute, JavaScript variable, and CSS comment is visible to anyone with a browser. Encoding does not equal encryption — it merely changes the representation of data, not its accessibility.