Spot The Difference — broncoctf2026

Description

My friend said that she updated file1 to send me a top-secret message, but I don't get it. File2 is still just a bunch of random characters?

Two files are provided: file1.txt (350 chars) and file2.txt (351 chars). Both are ASCII text that look like random character junk of similar length. The goal is to recover the "top-secret message" hidden in the update from file1 to file2.

Analysis

The two files are stored one character per line and are nearly identical. A byte-level diff shows they differ in 79 positions:

cmp -l file1.txt file2.txt   # 79 differing byte positions

Reading all 79 differing characters straight out of file2 produces garbage — this is the trap. The key insight is that the overwhelming majority of those 79 differences are pure case flips (e↔E, W↔w, C↔c, ...). These case-only edits are decoy / noise deliberately inserted to make a lazy diff produce nonsense.

The real payload lives only in positions where the two characters differ by more than letter case — i.e. where file1[i].lower() != file2[i].lower(). Filtering on this condition leaves exactly 29 substantive differences:

file1 side: gd6VeBn9ltja5VoTt3WmTyThP5q[C
file2 side: bronco{REDACTED}[C

Reading the file2 side up to the closing brace gives the flag. The trailing [C is spillover from the 1-character length mismatch between the files and lies outside the closed {...} braces.

Solution

Compare the two files character by character, discard every position that is only a case flip, and concatenate the surviving file2 characters.

#!/usr/bin/env python3
from pathlib import Path

a = Path('file1.txt').read_text().splitlines()
b = Path('file2.txt').read_text().splitlines()

# Keep only genuine (non-case-only) differences; read them from file2.
flag = ''.join(y for x, y in zip(a, b) if x.lower() != y.lower())
print(flag)  # bronco{REDACTED}[

The output is bronco{REDACTED}[; everything through the closing } is the flag.