Treasure Hunt — TJCTF 2026

Description

Let's go hunt down some treasure! The flag is split into 4 parts. I'll give you the first one right here: tjctf

English summary: A pirate-themed web page at https://treasure-hunt.tjc.tf running on gunicorn (Python WSGI). The flag is split into 4 parts hidden in different standard web locations. The first part is given in the challenge description.

Analysis

The main page is a pirate-themed site with a ship image and a "Learn More" button (POST form). The server runs gunicorn. Standard web reconnaissance locations need to be checked: HTML source, HTTP headers, robots.txt, and common endpoints.

Key observations:

• The page has a hidden HTML element not visible in the rendered page
• The "Learn More" button triggers a POST request that redirects to /extra_info (a red herring with a penguin image)
• The POST response includes a Set-Cookie header with a flag fragment
• robots.txt disallows a /gold-coffer endpoint

Solution

Part 1: Challenge Description → tjctf

Given directly in the challenge text.

Part 2: Hidden HTML Element → _and_

Viewing the page source reveals a hidden paragraph tag:

curl -s https://treasure-hunt.tjc.tf

<p hidden>_and_</p>

This element is not rendered by the browser but is visible in the HTML source.

Part 3: Set-Cookie Header → {s1lv3r

Submitting the POST form (clicking "Learn More") and inspecting the response headers:

curl -sv -X POST https://treasure-hunt.tjc.tf 2>&1 | grep -i set-cookie

Set-Cookie: silver_coffer={s1lv3r; Path=/

...