curl -s "https://booru.allthefallen.more/more?token=boru_block_survive" The server responded with a 200 OK and an HTML page that listed a single hidden image:
zsteg hidden_flag.jpg No hidden data were found; the flag was solely stored in the EXIF comment, confirming the intended solution. #!/usr/bin/env bash set -euo pipefail booru.allthefallen.more
boru_block_survive That string looked like a plausible token for the hidden endpoint. 3.1 Crafting the request The /more endpoint required the token to be supplied either as a query string ( ?token=… ) or as a cookie. Trying both: curl -s "https://booru
# 4️⃣ Pull the hidden image URL hidden=$(grep -oP '(?<=src=")/static/img/[^"]+\.jpg' more.html) Trying both: # 4️⃣ Pull the hidden image
BASE="https://booru.allthefallen.more"
# 1️⃣ Grab a random thumbnail to extract the token thumb=$(curl -s "$BASE/" | grep -oP '(?<=src=")/static/img/[^"]+\.jpg' | head -n1)
# 5️⃣ Download the hidden image and read the flag from EXIF curl -s "$BASE$hidden" -o hidden.jpg flag=$(exiftool -UserComment hidden.jpg | awk -F': ' 'print $2') echo "[+] Flag: $flag" Running the script prints:
curl -s "https://booru.allthefallen.more/more?token=boru_block_survive" The server responded with a 200 OK and an HTML page that listed a single hidden image:
zsteg hidden_flag.jpg No hidden data were found; the flag was solely stored in the EXIF comment, confirming the intended solution. #!/usr/bin/env bash set -euo pipefail
boru_block_survive That string looked like a plausible token for the hidden endpoint. 3.1 Crafting the request The /more endpoint required the token to be supplied either as a query string ( ?token=… ) or as a cookie. Trying both:
# 4️⃣ Pull the hidden image URL hidden=$(grep -oP '(?<=src=")/static/img/[^"]+\.jpg' more.html)
BASE="https://booru.allthefallen.more"
# 1️⃣ Grab a random thumbnail to extract the token thumb=$(curl -s "$BASE/" | grep -oP '(?<=src=")/static/img/[^"]+\.jpg' | head -n1)
# 5️⃣ Download the hidden image and read the flag from EXIF curl -s "$BASE$hidden" -o hidden.jpg flag=$(exiftool -UserComment hidden.jpg | awk -F': ' 'print $2') echo "[+] Flag: $flag" Running the script prints: