Base64 is not a secret
There is a message in the folder that looks like gibberish: letters, digits and an '=' at the end. A careless technician "protected" it this way. Find out what it hides and recover the flag.
Lab 1 of 6 in the Encodings & secrets path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 30 and 100 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Read the README (50 XP)
- Open the "protected" message (50 XP)
- Decode it with base64 -d (100 XP)
Topics: codici, base64.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.base64: encodes and decodes Base64, the format that turns bytes into text. It protects nothing: it can be undone without a key.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
Base64 is not encryption: it is only a way of writing bytes with 64 characters, and anyone can undo it with one command and no key. A secret "hidden" in base64 is in practice written in plain text (you often see it in config files, HTTP headers and tokens). To protect it you need real encryption with a key kept elsewhere and, for passwords, a salted hash; better still, do not write it in a note at all.
Before and after this lab
To unlock it you must have solved:
- Reading in pieces (Linux Fundamentals, easy)
After this lab you can move on to:
- Hexadecimal (Encodings & secrets, easy)
- Headers tell tales (Recon & Scanning, medium)
The Encodings & secrets path
Encodings & secrets teaches a distinction that saves a lot of data: encoding is not encrypting. Base64, hexadecimal, ROT13 and mirrored text change how information looks but do not protect it, because anyone can turn it back into plain text without a key. In the labs you recognise these formats by their look, peel them off one layer at a time even when they are stacked, extract readable text from a compiled program and understand why real protection needs real encryption, salted hashes and a secrets manager.