 What's up, YouTube? This is a video write-up for the challenge Lights Out, the second web challenge from ICTF 2018. The challenge prompt was help, we're scared of the dark and we're given a URL and a page that we can visit that doesn't have a whole lot in there. It says who turned out the lights and it's all black. So we can view the source, I'm gonna hit control you here. And it's basic bare bones HTML. There's not a lot here. Really just clear fix, data hide equals true, strong data show equals true. So it looks like they are trying to hide some things supposedly who knows. But there's not much that we can see in the HTML. So let's go exploring a little bit more. I want to check out what this main.css file is. And immediately it just looks like a bunch of garbage. But it is just bootstrap with some stuff in here. And it's all messy and kind of hard to read. So what I ended up doing is actually just going to the original page and checking out the sources with the developer tools. So I hit F12 or control shift K or control shift J with it depending on your on Firefox or Chrome, etc. And then we can check out, okay, what are we actually looking at here in the sources? We're given the HTML file. We're also given the main.css file. And it is kind of massive. That's fine. It looks like some comments are in the way. Neat trick. At least I don't know in Firefox, but I'm in Chrome right now in the developer tools, you can hit this, these curly braces here and that will pretty print or kind of format what you're looking at. So I was able to kind of explore these and take a look at them on our own. And I thought, well, they must be trying to hide something here because that text was so big, I thought they would be trying to do something weird. So I started to look for the like flag format, I CTF, I didn't get anything. I look for just CTF. And then I got a hit. It said the data hide before has content CTF. And that's looks like the start of the flag form that looks like a piece or a fragment of the flag. So I thought in my mind, okay, this must be the game. This must be the move here is that they've hidden different pieces of the actual CTF here and the flag format all in a different HTML element with kind of hiding it in data hide or setting a color so it's invisible, trying to hide the background and stuff. So if we were to actually even change the background color, if you wanted to try and manipulate some of the CSS, you totally could want to try and find the background here. Background color, we can just go to like white or something. But again, all of these invisible things are hidden as invisibility or and we can comment some of these lines out and see if some of them will end up displaying pieces of the flag. Or you could just start to track down pieces of the flag by searching for them within the CSS. Like you can see this one here has another segment of the flag determined kind of by the curly brace ending here. And they're using just the content property. There's every single element and every single property is just being set with the content. So it's not visible in the HTML, but it's set by the CSS. So if we wanted to, we could just simply search for content and get pieces of the flag. We saw ice. Let's get a text editor open where we can start to piece these together. We saw ice CTF colon. And then the lights was at the very end of that content underscore somewhere. Looks like that doesn't have any real data, but the lights there turned styles turned in our underscore. So styles turned the lights, maybe that should be the flag. Like we can try it out. We can submit it if we wanted to test it. And it says, Oh, styles turned the lights forgot the S there. Yes. In the background, you can see the checkbox. We did solve that challenge. That was the flag odd and weird. I was kind of hoping you can probably tweak the CSS a little bit or turn things visible where you actually would be able to like view the page and have to have it display out the flag for you just written on on the HTML page. But I didn't mess with it long enough to be I actually even care. I thought, Okay, if I can just find the content and piece together the flag just like that, that's fine. No need to write a stupid get flag challenge or get flag script for this. It is kind of a admittedly stupid challenge. It's kind of a little scavenger on whatever. I love you guys. I CTF creators are the best. A quick shout out to the people that support me on Patreon. Thank you guys so much. $1 a month or more on Patreon will give you a special shout out just like this at the end of every video. $5 or more on Patreon will give you early access to everything that released on YouTube before it goes live. Because I like to record in bulk and then gradually let YouTube schedule and release them. If you did like this video, you're into CTF's program and other cool stuff, please do join our Discord server link in the description. It's a pretty cool community of CTF players, programmers, and hackers. If you want to hang out with me and, you know, other cool people that love this stuff, that's the place to do it. Thanks guys. Appreciate you watching. Please do like, comment, and subscribe. We'd love to see you on Patreon. We'd love to see you in the next video. Later.