JS Safe 6.0

GoogleCTF2025

Task: single-file HTML JS Safe whose password is the flag, hidden behind layered JavaScript anti-debug/obfuscation (Unicode-identifier/whitespace tricks, tagged-template tag functions, ROT13/ROT47, no-op double(), DevTools debug() breakpoint instrumentation driving a window.step counter). Solution: statically untangle the layers to prove the validation loop only progresses on a match (so the flag is a deterministic Park-Miller-LCG descramble / exact anagram of an internal pool), then drive real Chrome via CDP with conditional breakpoints to evolve window.step and recover the 49-char ordering.