Skip to content

Chapter 1: Exploration

Category: Web / API Recon    |    Points: 2    |    Difficulty: Easy/Medium

🧠 Challenge Text

Hi Senior Researcher,

an unknown perpetrator is attempting to discredit the national research and education network (NREN) and, on their domain theylietoyou.tcc, is publishing entirely unverified hoaxes, fake news, and other thoroughly unscientific content aimed against the mission of the NREN.

Law enforcement authorities have already been informed and they could use your assistance to gather as much information as possible. More information can be found on the website http://theylietoyou.tcc/story-line.

Stay curious!

🔍 Hints Text

No hints were provided.

🎨 Solution

The site at theylietoyou.tcc is a React/Vite SPA. The JS bundle reveals: - API base URL: http://api.theylietoyou.tcc

The author credentials are accessible at http://theylietoyou.tcc/story-line - Credentials: newWarrior / chAng3melaTer123

Endpoint path enumeration found Swagger/OpenAPI docs publicly exposed: - /swagger-ui/index.html — Swagger UI - /v3/api-docs — OpenAPI 3 spec

By checking /v3/api-docs endpoint and hit CTRL-F for flag reveals the TokenResponse schema description in the OpenAPI spec contains the flag:

JWT access token returned after successful authentication.
This JWT is also very important for our DEV environment (untraceable-dev.theylietoyou.tcc)!
FLAG{McUs-Wrjs-8MbE-SiIt}

Also reveals a dev environment: untraceable-dev.theylietoyou.tcc

Key API endpoints discovered

  • POST /api/auth/login — login
  • POST /api/auth/token — refresh token
  • GET /api/news/published — public news
  • GET /api/profile — current user profile
  • GET /api/dashboard — stats
  • POST /api/admin/impersonate/{userId} — impersonate user (admin only)
  • GET /api/admin/users — list users (admin only)
  • GET /api/admin/users/{userId}/meta/{metaId} — user metadata (admin only)
  • GET /api/admin/conf — config (admin only)
  • GET /api/admin/flag — flag (admin only, returns separate flag?)

Known users from articles

  • jsmith, mjohnson, wbrown, jgarcia, ermartinez, fmitchell and newWarrior