Advent of CTF - Challenge 1

“The Source”


This is the first challenge in the Advent of CTF series. The first of a total of 24 that covers the entire month of December.

As it is the first it is intended to be beginner friendly. It also is meant to get people familiar with the system I have setup to claim badges and points.

What you will learn

The challenge will learn the player to:

  • Inspect page source
  • How to identify and decode Base64 encoding
  • How to work with the Advent of CTF system


The challenge is available at Once requested the user is faced with a box to input Santa’s password.

Figure 1: Challenge webpage

Obviously there are hints on the page. The player needs to find a password to enter into the box. In the footer there is a reference to star wars, which was famous for the quote Use the force, Luke!. In a CTF context that might sound like Use the source. Using Inspect source will show something at the very bottom.

Figure 2: An encoded string

The hint in the comment is This is an odd encoded thing right?. The string that follows seems to be something that has been encoded. When the string is used as an input in CyberChef it will immediatly say there is a Magic function it can apply.

Figure 3: CyberChef magic wand

When you click the magic wand the text will be decoded. It will show advent_of_ctf_is_here. This is the password that you can enter to unlock Santa’s secrets.

Figure 4: The flag

The flag can be entered into the score board at and also a badge can be retrieved for social media. When you follow the link to the Badge Service you can enter the flag.

Figure 5: The badge service

When you hit Go! a unique badge will be displayed with the ability to share on social media.

Figure 6: The unique badge

You have solved the challenge and claimed your points. You also claimed your social media badge! The challenge is completed.

Honorable Mentions

I would like to take this moment to thank Semper Fight (@DennisFeijth on Twitter) for finding a bug in the Badge Service. Fixed before we even started.

Go back to the homepage.