Rating:

We start on a page with a `Press Me` button, that moves when you get too close to it with your mouse. The eyes follow too, cute!

![](https://raw.githubusercontent.com/Crypto-Cat/ctf-writeups/refs/heads/main/2025/nops_25/web/press_me_if_you_can/images/0.PNG)

The JS contains all the logic for the animation, movement etc. That's not too important though, we just need to click the button so should find it's declaration.
```js
const btn = document.querySelector("button");
```

Later in the script, it is disabled.
```js
btn.disabled = true;
```

We can modify these properties from the browser console, and click the button.
```js
btn.disabled = false;
btn.click();
```

A POST request is issued, and the response contains our flag (displayed in the console log).

Flag: `N0PS{W3l1_i7_w4S_Ju5T_F0r_Fun}`

Original writeup (https://book.cryptocat.me/ctf-writeups/2025/n0ps/web/press_me_if_you_can).