Treasure Hunt — TJCTF 2026

Description

Let's go hunt down some treasure! The flag is split into 4 parts. I'll give you the first one right here: tjctf

English summary: A pirate-themed web page at https://treasure-hunt.tjc.tf running on gunicorn (Python WSGI). The flag is split into 4 parts hidden in different standard web locations. The first part is given in the challenge description.

Analysis

The main page is a pirate-themed site with a ship image and a "Learn More" button (POST form). The server runs gunicorn. Standard web reconnaissance locations need to be checked: HTML source, HTTP headers, robots.txt, and common endpoints.

Key observations:

• The page has a hidden HTML element not visible in the rendered page
• The "Learn More" button triggers a POST request that redirects to /extra_info (a red herring with a penguin image)
• The POST response includes a Set-Cookie header with a flag fragment
• robots.txt disallows a /gold-coffer endpoint

Solution

Part 1: Challenge Description → tjctf

Given directly in the challenge text.

Part 2: Hidden HTML Element → _and_

Viewing the page source reveals a hidden paragraph tag:

curl -s https://treasure-hunt.tjc.tf

<p hidden>_and_</p>

This element is not rendered by the browser but is visible in the HTML source.

Part 3: Set-Cookie Header → {s1lv3r

Submitting the POST form (clicking "Learn More") and inspecting the response headers:

curl -sv -X POST https://treasure-hunt.tjc.tf 2>&1 | grep -i set-cookie

Set-Cookie: silver_coffer={s1lv3r; Path=/

The server responds with a 302 redirect to /extra_info (which shows a penguin image — a red herring) and sets a cookie named silver_coffer containing the third flag part.

Part 4: robots.txt → Disallowed Endpoint → g0ld}

Checking the standard robots.txt file:

curl -s https://treasure-hunt.tjc.tf/robots.txt

User-agent: *
Disallow: /gold-coffer
Allow: /

Visiting the disallowed endpoint:

curl -s https://treasure-hunt.tjc.tf/gold-coffer

Returns the plain text: g0ld}

Flag Assembly

Combining all 4 parts in order:

Part	Source	Value
1	Challenge description	tjctf
2	Hidden HTML <p> tag	{s1lv3r
3	Set-Cookie header	_and_
4	/gold-coffer endpoint	g0ld}

Flag: tjctf{REDACTED}