Cyber League 2025

I got lazy brrrrrrrrrrr

Log Analysis

In this file, we are given a whole bunch of logs. However, there is something out of the ordinary here

f1a9=flag????

Lets try to get all the logs which contain f1a9...

└─$ cat log_challenge.log | grep f1a9
67.28.91.98 - - [06/May/2020:05:24:02 -0400] "POST /supersecure/search.jsp?f1a9=43 HTTP/1.0" 404 4984 "http://gilmore-cohen.com/main/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/5322 (KHTML, like Gecko) Chrome/14.0.808.0 Safari/5322"
150.97.134.17 - - [06/May/2020:07:08:25 -0400] "GET /supersecure/search.jsp?f1a9=59 HTTP/1.0" 200 4929 "http://www.lee.biz/list/search/login.asp" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/5311 (KHTML, like Gecko) Chrome/15.0.863.0 Safari/5311"
244.23.92.208 - - [06/May/2020:08:39:45 -0400] "GET /supersecure/search.jsp?f1a9=42 HTTP/1.0" 200 5012 "http://wells.com/login.htm" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_7; rv:1.9.5.20) Gecko/2017-04-01 11:18:21 Firefox/3.8"
103.63.127.117 - - [06/May/2020:09:03:20 -0400] "GET /supersecure/search.jsp?f1a9=45 HTTP/1.0" 200 4917 "http://murray.org/categories/category/privacy/" "Mozilla/5.0 (compatible; MSIE 5.0; Windows CE; Trident/4.0)"
12.195.42.88 - - [06/May/2020:09:36:54 -0400] "DELETE /supersecure/search.jsp?f1a9=52 HTTP/1.0" 200 4974 "http://www.morales.com/faq/" "Opera/8.76.(X11; Linux i686; sl-SI) Presto/2.9.175 Version/12.00"
212.138.7.238 - - [06/May/2020:09:55:08 -0400] "GET /supersecure/search.jsp?f1a9=4c HTTP/1.0" 200 5034 "http://burns.com/tag/explore/list/category/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/5361 (KHTML, like Gecko) Chrome/14.0.809.0 Safari/5361"
102.70.196.255 - - [06/May/2020:10:43:06 -0400] "GET /supersecure/search.jsp?f1a9=45 HTTP/1.0" 200 5016 "http://rodriguez-silva.com/faq/" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/5350 (KHTML, like Gecko) Chrome/14.0.880.0 Safari/5350"
25.189.211.143 - - [06/May/2020:12:50:48 -0400] "POST /supersecure/search.jsp?f1a9=41 HTTP/1.0" 200 5037 "http://brown-hinton.org/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/5331 (KHTML, like Gecko) Chrome/13.0.897.0 Safari/5331"
136.242.188.13 - - [06/May/2020:13:51:59 -0400] "PUT /supersecure/search.jsp?f1a9=47 HTTP/1.0" 200 4890 "http://gilbert.biz/category/categories/tags/index.html" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/5322 (KHTML, like Gecko) Chrome/14.0.896.0 Safari/5322"
219.14.89.223 - - [06/May/2020:15:38:43 -0400] "GET /supersecure/search.jsp?f1a9=55 HTTP/1.0" 200 5030 "http://www.huber-rodriguez.com/tags/homepage/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7_8; rv:1.9.4.20) Gecko/2017-06-05 16:30:07 Firefox/3.6.8"
147.186.94.150 - - [06/May/2020:15:40:11 -0400] "GET /supersecure/search.jsp?f1a9=45 HTTP/1.0" 200 4899 "http://velasquez.net/tags/list/post/" "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/2011-09-21 09:55:50 Firefox/3.8"
147.186.94.150 - - [06/May/2020:15:43:05 -0400] "GET /supersecure/search.jsp?f1a9=7b HTTP/1.0" 200 4899 "http://velasquez.net/tags/list/post/" "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/2011-09-21 09:55:50 Firefox/3.8"
153.12.246.112 - - [06/May/2020:18:20:17 -0400] "GET /supersecure/search.jsp?f1a9=6c HTTP/1.0" 200 5022 "http://sanchez.com/register/" "Mozilla/5.0 (Windows NT 5.01; en-US; rv:1.9.2.20) Gecko/2014-05-08 23:58:58 Firefox/14.0"
219.29.80.158 - - [06/May/2020:22:29:45 -0400] "POST /supersecure/search.jsp?f1a9=30 HTTP/1.0" 200 4961 "http://www.hanson-pitts.com/search.asp" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_1; rv:1.9.3.20) Gecko/2015-06-28 09:59:07 Firefox/4.0"
200.145.104.64 - - [06/May/2020:23:34:10 -0400] "PUT /supersecure/search.jsp?f1a9=67 HTTP/1.0" 200 4971 "http://www.calderon-mccall.info/app/main/privacy.html" "Opera/8.70.(Windows NT 6.1; sl-SI) Presto/2.9.184 Version/12.00"
214.119.228.116 - - [07/May/2020:00:41:37 -0400] "GET /supersecure/search.jsp?f1a9=73 HTTP/1.0" 200 5054 "http://burgess.com/home.htm" "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/2017-08-13 02:19:36 Firefox/14.0"
63.162.198.226 - - [07/May/2020:00:59:50 -0400] "GET /supersecure/search.jsp?f1a9=5f HTTP/1.0" 200 5063 "http://williams.com/list/app/faq/" "Opera/8.61.(X11; Linux x86_64; it-IT) Presto/2.9.184 Version/12.00"
220.39.220.10 - - [07/May/2020:02:16:25 -0400] "GET /supersecure/search.jsp?f1a9=52 HTTP/1.0" 200 4920 "http://www.wise.com/main/faq/" "Mozilla/5.0 (Windows 98; it-IT; rv:1.9.2.20) Gecko/2020-02-25 05:02:18 Firefox/8.0"
25.113.62.239 - - [07/May/2020:03:12:46 -0400] "GET /supersecure/search.jsp?f1a9=5f HTTP/1.0" 200 4993 "http://www.johnson.com/blog/category.jsp" "Mozilla/5.0 (Macintosh; PPC Mac OS X 10_7_7; rv:1.9.3.20) Gecko/2019-07-10 08:38:07 Firefox/3.8"
164.56.161.25 - - [07/May/2020:03:58:31 -0400] "GET /supersecure/search.jsp?f1a9=62 HTTP/1.0" 200 5021 "http://martinez-rodgers.com/categories/main/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/5312 (KHTML, like Gecko) Chrome/14.0.885.0 Safari/5312"
27.220.235.141 - - [07/May/2020:04:14:18 -0400] "DELETE /supersecure/search.jsp?f1a9=30 HTTP/1.0" 200 5023 "http://morrow-garcia.com/tags/categories/categories/register.htm" "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/2011-03-13 12:03:50 Firefox/3.8"
151.167.162.144 - - [07/May/2020:04:18:43 -0400] "GET /supersecure/search.jsp?f1a9=52 HTTP/1.0" 200 4970 "http://bates.com/post/" "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/2011-04-23 21:09:39 Firefox/15.0"
6.157.87.123 - - [07/May/2020:05:21:59 -0400] "GET /supersecure/search.jsp?f1a9=69 HTTP/1.0" 200 5029 "http://francis.com/post/" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/5321 (KHTML, like Gecko) Chrome/15.0.808.0 Safari/5321"
214.155.76.196 - - [07/May/2020:06:30:37 -0400] "GET /supersecure/search.jsp?f1a9=4e HTTP/1.0" 200 4923 "http://www.hoover.org/search/search/" "Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/2013-09-22 08:46:40 Firefox/5.0"
159.124.162.18 - - [07/May/2020:07:04:02 -0400] "GET /supersecure/search.jsp?f1a9=67 HTTP/1.0" 200 5016 "http://hernandez.com/terms.html" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6) AppleWebKit/5331 (KHTML, like Gecko) Chrome/13.0.807.0 Safari/5331"
44.229.213.155 - - [07/May/2020:07:47:48 -0400] "GET /supersecure/search.jsp?f1a9=7d HTTP/1.0" 200 4941 "http://lambert.com/index/" "Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/2015-05-19 07:43:07 Firefox/10.0"

Now since there are integers after f1a9 lets try decoding them.

From this, we get the flag CYBERLEAGUE{l0gs_R_b0RiNg}