Tags: misc web 

Rating:

Going on the given portal first thing you notice is a link given to [`Our first official response`](http://foi.uni.hctf.fun/docs/document_001.pdf) and that is a PDF but that pdf doesn't have anything insteresting but what is interesting is the URL itself `http://foi.uni.hctf.fun/docs/document_001.pdf` notice the number in the `001` well changing that changes the PDF. So let's get all the pdf's

from os.path import join
import requests

URL = "http://foi.uni.hctf.fun/docs/"
PATH = "~/Downloads/PWN/documents/"
i = 1

while(i < 300):
name = "document_%03d.pdf" % i
print("GETTING >>>> ", name)
url = join(URL, name)
r = requests.get(url, stream=True)

if (r.status_code == 200):
with open(join(PATH, name), 'wb') as f:
f.write(r.content)
else:
print("adios >>>> ", name)

i += 1

In the code we are simply saving all the PDF's we can get and skipping the one's that are not available. But why only till `300`, well one of my team mate figured out that there's nothing present after `300`. Obviously there can be a better way then to save all PDFs but there are only `243` pdf of total size : 6.37. Nothing to worry about.
After all the pdfs are downloaded just use [`pdfgrep`](https://pdfgrep.org/)

➜ pdfgrep -r "flag" ~/Downloads/PWN/documents/

And you'll have

~/Downloads/PWN/documents//document_255.pdf:Here it is: flag{F1rst_Gr4d3rs_4r1thm3t1c_1s_d4ng3r0us}