Tags: javascript brute-force deobfuscation
Rating:
**Full write-up:** https://www.sebven.com/ctf/2021/07/30/ImaginaryCTF2021-Password-Checker.html
Web – 450 pts (15 solves) – Chall author: Zyphen
An online ‘password checker’ with some (regex) obfuscated verification function. Running it through any online deobfuscator reveals the internal structure of the code. Some additional cleaning allows us to recover the restrictions on the input for us to get the flag. I chose to opt for brute-force (I like it rough) and to abuse the most ingenious invention of humankind, language.