picoCTF · picoGym Web Exploitation Easy 50 pts

WebDecode — Base64 in HTML Attributes

OWASP A02 — Cryptographic Failures

Vulnerability Overview

Sensitive data was embedded in the HTML source code inside a non-standard attribute, encoded with Base64. Like all client-side storage, HTML attributes are fully visible to any user who views the page source.

Discovery

Navigating through the site's pages and viewing source revealed a suspicious attribute on the About page:

<section class="about" notify_true="cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRfMDJjZGNiNTl9">

The attribute notify_true serves no legitimate HTML purpose. Its value — a string of alphanumeric characters with no spaces — matched the Base64 character set. Decoding it directly produced the flag.

Encoding Recognition Cheatsheet

PatternEncoding
Ends with = or ==Base64
Only a-f and 0-9, even lengthHexadecimal
Letters shifted by 13 positionsROT13
%3D, %2F, %20URL encoding
Key Insight: The client side is the attacker's side. Every HTML attribute, JavaScript variable, and CSS comment is visible to anyone with a browser. Encoding does not equal encryption — it merely changes the representation of data, not its accessibility.
Flag See challenge on picoCTF picoGym