Rating:

Guestbook - Web

In this challenge we got an HTML File. I opened it in the browser and in VS code. Note that the sheetID is exposed and we can view only the last entries.

Googling/using chatGPT I understood that I can try accessing a certain sheet using its sheet ID using the following URL: https://docs.google.com/spreadsheets/d/[sheetID}/edit

I entered this link using the sheet ID in the code and I retrieved the flag.

uoftctf{@PP_5cRIP7_!5_s0_coOL}

Original writeup (https://www.thesecuritywind.com/post/uoftctf-2024-writeups#viewer-lrxuf909873).