Booru.allthefallen.more — Work

curl -s -o hidden_flag.jpg "https://booru.allthefallen.more/static/img/hidden_flag.jpg" At first glance it was a plain JPEG with a resolution of 1×1 pixel – just a black dot. Running exiftool again gave:

boru_block_survive That string looked like a plausible token for the hidden endpoint. 3.1 Crafting the request The /more endpoint required the token to be supplied either as a query string ( ?token=… ) or as a cookie. Trying both: booru.allthefallen.more

[+] Token extracted: boru_block_survive [+] Flag: flagb0oru_4ll_th3_f4ll3n_m0r3 | Technique | Why it mattered | |-----------|-----------------| | Directory brute‑forcing (ffuf/DirBuster) | Discovered the hidden /more endpoint. | | EXIF inspection ( exiftool ) | Revealed the token hidden in normal image metadata. | | Base64 decoding | Turned the encoded token into a usable string. | | Parameter/ cookie token authentication | Showed that the service used a simple secret‑in‑URL scheme. | | Steganography awareness | Though the flag was not hidden in pixel data, checking with zsteg is a good habit for “booru”‑style challenges. | curl -s -o hidden_flag

<!-- token is stored in the image EXIF --> All thumbnails were JPEG files served from /static/img/<hash>.jpg . Downloading a few of them with wget and inspecting the EXIF data ( exiftool ) revealed a custom tag: | | Parameter/ cookie token authentication | Showed

<!-- see /more for the rest --> Running a quick DirBuster/ffuf scan against the root with a small wordlist ( common.txt ) uncovered a hidden endpoint: