$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: Extract a flag from a network service that reveals only one character at a time per connection. Solution: Script automated connections to query each character index sequentially, determine the flag length via binary search or linear scan, and reconstruct the full flag string.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Category: Misc / Network
Difficulty: Easy
Description: "Security through Induced Boredom is a personal favourite approach of mine. Not as exciting as something like The Fray, but I love making it as tedious as possible to see my secrets, so you can only get one character at a time!"
The challenge presents a network service that allows querying individual characters of a flag, one position at a time. This is a classic "tedious access" challenge where manual extraction would be impractical, making scripting essential.
Connection: nc 94.237.122.95 37667
When connecting to the service, we receive a prompt asking for a character index:
Which character (index) of the flag do you want? Enter an index:
The service responds with the character at the requested position. This is a straightforward interface:
Key observations from testing the service:
Since we don't know the flag length, we need to discover it. We can use binary search to efficiently find the maximum valid index:
...
$ grep --similar