SCCDU // EXERCISE 04 ← back to mission list

Read Between the Lines

Not everything on a web page is meant to be seen by visitors. Developers sometimes leave notes in a page's source code — and if those notes contain anything sensitive, anyone can find them. This exercise teaches how to view a page's source code and decode a simple obfuscation technique called Base64.

SCCDU STAFF PORTAL

This login page is not fully built yet. Please check back later.

// STEP 1 — VIEW THE PAGE SOURCE

There is a hidden note somewhere in this page's underlying code. Try one of these:

  1. Right-click anywhere on this page and choose View Page Source (or press Ctrl + U on Windows/Linux, Cmd + Option + U on Mac).
  2. Or right-click and choose Inspect / Inspect Element to open the developer tools, then look through the <html> for an HTML comment (comments look like <!-- text -->).
New to this? Here's exactly how to approach it: web developers sometimes leave themselves notes inside a page's code, called "comments." A normal visitor never sees these — they only show up if you go looking at the actual code behind the page, not the page itself. Once you're viewing the source, scan through it for anything wrapped in <!-- and -->; that marks the start and end of a comment. What you're looking for inside it is a long, random-looking jumble of letters, numbers and symbols — that's a message that's been encoded (not really "encrypted," just disguised) using something called Base64. Once you've found and copied that string, open CyberChef using the button below, search for From Base64 in the Operations list on the left, and drag it into the empty Recipe area in the middle. Paste your string into the Input box in the top right. CyberChef usually decodes it instantly, but if nothing appears in the Output box, look for a button labelled Bake near the top of the Recipe area and click it — that tells CyberChef to run the recipe and show you the result.

// STEP 2 — DECODE THE MESSAGE

The comment contains a long string of letters and numbers — that's a message encoded using Base64, a common way to turn text into a different-looking block of characters. It isn't encryption and isn't secret, just disguised — which is exactly why security teams check for it. Paste the whole encoded string into CyberChef to reveal a short internal memo. Read it carefully — the flag is written inside it.

Open CyberChef in a new window ↗

In CyberChef, search the Operations list for From Base64, drag it into the Recipe area, then paste the encoded string into the Input box.

// STEP 3 — SUBMIT THE FLAG

Why does this matter in the real world? (click to expand)

Developers occasionally leave comments containing test passwords, internal URLs, or API keys in code that ends up published live. Security professionals routinely check a site's source code for exactly this kind of accidental leak — it's a real, common finding in security reviews.