https://anthr4ce.github.io/tags/dvctf/Recent content in DVCTF on Anthrace | CTF WriteupsHugoen-usMon, 26 May 2025 00:00:00 +0000https://anthr4ce.github.io/ctf-writeups/dvctf-2025/web-louvrearchives/Mon, 26 May 2025 00:00:00 +0000https://anthr4ce.github.io/ctf-writeups/dvctf-2025/web-louvrearchives/<hr> <p><img src="images/img1.png" alt="Screenshot"></p> <p>In this challenge, the goal is to access <code>flag.webp</code> as indicated in the source code.</p> <p>While exploring the page, I noticed a long base64-encoded string. Once decoded and reorganized, it contained several <code>.webp</code> images with unusual names like <code>1991781613.webp</code>, <code>1273827392.webp</code>, etc.</p> <p>Checking the source code:</p> <p><img src="images/img2.png" alt="Screenshot"></p> <p>We understand that filenames are generated using Python&rsquo;s <code>getrandbits(32)</code>, which produces 32 random bits via the <code>random.getrandbits</code> function.</p> <p>The interesting point here is that this function uses the <strong>Mersenne Twister</strong> generator, a PRNG (Pseudo-Random Number Generator) that is <strong>not cryptographically secure</strong>.</p>