Canvas - HackTheBox Challenge Writeup

Challenge Information

Description

The challenge presents a scenario where a developer has left a company, and the website needs to be updated. The task is to investigate the codebase and uncover hidden information—specifically a flag that has been concealed within the application files.

Solution Overview

The flag was not located in the obvious location (a decoy in dashboard.html), but rather hidden within the JavaScript code in login.js. The flag was encoded using hex values and the String.fromCharCode() method, stored as an unused variable that was never rendered to the page.

Key Steps

1. Initial Reconnaissance

Begin by exploring the challenge directory structure:

ls -la <workdir>

This reveals the files available in the challenge environment.

2. File Analysis

Examine the challenge description and available files:

cd <workdir> && cat description.md

3. Source Code Investigation

Review the application files, particularly:

• dashboard.html — Contains a decoy flag (red herring)
• login.js — Contains the actual flag, hex-encoded using String.fromCharCode()

4. Flag Extraction

The flag was hidden as an array of hex codes in login.js:

# Hex codes representing the flag characters
codes = [0x48, 0x54, 0x42, 0x7b, 0x57, 0x33, 0x4c, 0x63, 0x30, 0x6d, 0x33,
         0x5f, 0x37, 0x30, 0x5f, 0x4a, 0x34, 0x56, 0x34, 0x35, ...]

# Convert hex codes to ASCII characters
flag = ''.join(chr(code) for code in codes)

Decode the hex values to retrieve the flag:

python3 -c "
codes = [0x48, 0x54, 0x42, 0x7b, 0x57, 0x33, 0x4c, 0x63, 0x30, 0x6d, 0x33,
         0x5f, 0x37, 0x30, 0x5f, 0x4a, 0x34, 0x56, 0x34, 0x35]
flag = ''.join(chr(code) for code in codes)
print(flag)
"

Flag: HTB{REDACTED}

Key Learnings

1. Look Beyond the Obvious — Decoy flags can be intentionally placed in visible locations like HTML files to mislead solvers. Always check all source files thoroughly.

2. JavaScript Code Analysis — Unused variables and seemingly dead code in JavaScript can hide important information. Review the entire codebase, not just rendered elements.

3. Hex Encoding Patterns — Flags encoded via String.fromCharCode() with hex values are a common obfuscation technique in CTF challenges. Recognize this pattern and extract the character codes.

4. Real-World Relevance — This challenge mirrors a real scenario: when a developer leaves suddenly, hidden or poorly documented code can become a security risk or access barrier. Always maintain clear documentation and code reviews.

Tools Used

• Bash — File navigation and exploration
• Python 3 — Hex decoding and flag extraction
• Text editors — Source code examination

Conclusion

Canvas demonstrates the importance of thorough code review and not trusting obvious solutions. By examining all source files and recognizing hex encoding patterns in JavaScript, the hidden flag was successfully extracted.