Javascript - Obfuscation 1

• Difficulty: Very easy

---

🔎 Solution

The challenge website displays a popup requesting a password.

Examining the web source code reveals the following script:

/* <![CDATA[ */

pass = '%63%70%61%73%62%69%65%6e%64%75%72%70%61%73%73%77%6f%72%64';
h = window.prompt('Entrez le mot de passe / Enter password');
if(h == unescape(pass)) {
  alert('Password accepté, vous pouvez valider le challenge avec ce mot de passe.\nYou an validate the challenge using this pass.');
} else {
  alert('Mauvais mot de passe / wrong password');
}

/* ]]> */

The password string is URL-encoded. Decoding it reveals the string below, which is the challenge flag:

cpasbiendurpassword

🚩Flag

cpasbiendurpassword