 Hey YouTube, this is another video right up for the challenge Moral Horses for 40 points in a web category of TJCTF, a recent capture of the flag competition. So the challenge prompt here is the horse is back and it gives us a web address and web page that we can check out. I actually had better luck looking at this in Firefox and honestly true credit and props goes to Yiggles Moto because I think he was the one that originally found the lead on this and figured it out because a lot of people struggled with this challenge because it didn't make a whole lot of sense. It said scroll down to find the flag. It's the regular infinity horse sling where the page would just keep loading and scrolling and you would just see legs in this ASCII picture of the horse over and over and over again. There didn't seem to be a whole real gimmick to it and it was nothing in the source code, nothing on like any of their HTTP headers, it was just nothing there. So what he did and what he pointed me to was that you can actually just literally scroll like programmatically scroll because you'll see if you set up a network query you'll see the web page will continually get legs like this HTML page over and over and over again and that one will always have the response of okay more HTML legs and oops you couldn't get the flag. That's dumb. So what we had done and what Yiggles had done is we had set up a... Okay, I gotta stop saying we but he I'm showing case and showcasing you love and the support that this was totally your challenge. So thank you for everything you do on the team. What he'd done it had set up a window interval so that every now and again we could just be running a new function over and over and over again to scroll and scroll by lines and I think just a thousand or whatever is fine, crazy amount and then we can set it for as often as we want to just like over and over again create requests and slowly get more legs. So you can see the number of requests is going up, the scroll bar is increasing because we are getting more and more. So each of these HTML responses are normally in size 707 bytes but what if one of them does contain the flag as the only direction that we're told here is to scroll and to keep scrolling maybe at some point one of these will have a different result. So the best way we can determine that is to sort by size and this is going to take a little bit of time and I don't honestly know how long it will take but at the very very top since we're sorting by size one of these will return something other than 707 bytes. So I'll pause the recording and I'll get back to you when that happens. Okay it didn't take much long at all just a few seconds after I said that we did get 704 bytes which we can take a look at go ahead and view the response over here in the preview we do have our flag. So that challenge was weird in that there wasn't a whole lot of guidance other than just scrolling and you literally had to kind of go with it just buy it and hold your breath hope that you would eventually get there. So we can go ahead and save that if we particularly wanted to. We can make a directory for more horses and save that flag just in there but that is the solution to more horses is to literally scroll forever until you get a response that is your flag. Cool hey I want to give a special shout out and some love to people that support me on Patreon you guys are fantastic. One dollar a month or more on Patreon will give you a special shout out just like this at the end of every video five dollars or more on Patreon will give you early access everything that I release on YouTube before it goes live. If you did like this video and you want to see more CTF video write-ups or programming tutorials or other stuff that I do please do like comment and subscribe join our discord server link in the description if you want another cool community of CTF players hackers and programmers if you want to jam with me or anyone else when we're planning cool CTF upcoming that's the awesome and best place to do it in. Hey I would love to see your support on Patreon and I hope to see you in the next video. Thanks.