# ▼▼▼guess5(Crypto:200) 97/605=16.0％▼▼▼
**This writeup is written by [@kazkiti_ctf](https://twitter.com/kazkiti_ctf)**

```
https://glgaines.github.io/guess5/
made by glg
Hint: Challenge is working as expected.
```

---

**【Grasp function】**

Enter 6 numbers and press submit button,but the request was not sent.

↓

It seems to be judging with javascript

---

**【Confirm javascript】**

```
GET /guess5/js/app.js HTTP/1.1
Host: glgaines.github.io
```

↓

```
createGuesses: function() {
var _guess0 = $("#input_guess0").val();
var _guess1 = $("#input_guess1").val();
var _guess2 = $("#input_guess2").val();
var _guess3 = $("#input_guess3").val();
var _guess4 = $("#input_guess4").val();
var _guess5 = $("#input_guess5").val();
```

↓

A value is assigned to a `createGuesses function`

---

Search where you are using `createGuesses function`

↓

```
GET /guess5/Guess6.json HTTP/1.1
Host: glgaines.github.io
```

↓

```
createGuesses(guesses);\r\n }\r\n\r\n function createGuesses(uint8[6] guesses) public view returns (uint[7], string) {\r\n uint[7] memory resultArray;\r\n uint16 adder = guesses[0] + guesses[1] + guesses[2] + guesses[3] + guesses[4] + guesses[5];\r\n uint16 correctCount = 0;\r\n string memory result_answer;\r\n\r\n uint timeNow = now/100 + adder;\r\n resultArray[0] = timeNow % 9;\r\n resultArray[1] = timeNow % 3;\r\n resultArray[2] = timeNow % 5;\r\n resultArray[3] = timeNow % 7;\r\n resultArray[4] = timeNow % 8;\r\n resultArray[5] = timeNow % 2;\r\n\r\n resultArray[6] = timeNow;\r\n\r\n for(uint8 i = 0; i < 6; i++){\r\n if(resultArray[i] == guesses[i]) {\r\n correctCount++;\r\n }\r\n }\r\n if (correctCount == guesses.length){\r\n result_answer = \"you got the Flag: WPI{All_Hail_The_Mighty_Vitalik}\";\r\n } else {\r\n result_answer = \"Try again\";\r\n }\r\n return (resultArray, result_answer);\r\n }\r\n}\r\n",
"sourcePath": "C:\\Users\\glgai\\ChainSkills\\CTF\\guess\\contracts\\guess6.sol",
```

↓

`WPI{All_Hail_The_Mighty_Vitalik}`