Message For You | Enes Basmaci

01 · CONTEXT

Description of the Challenge

Please find my hidden message.

02 · RECON

Recon / Initial Analysis

CODEShorted app.pyPYTHON

from flask import Flask, session
import os
import secrets 

FLAG = os.environ.get("FLAG", "Alpaca{**REDACTED**}")

app = Flask(__name__)
app.secret_key = secrets.token_hex(32)

MESSAGE = f"""
Roses are red,
Violets are blue,
I've hidden a flag
In a session for you: {FLAG}
""".strip()

@app.get("/")
def index():
    session["message"] = MESSAGE
    return HTML

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=3000, debug=True)

We can observe that the MESSAGE variable contains the flag we are looking for. When a request is made to the / endpoint, the application stores this message inside the Flask session.

03 · SOLUTION

Solution

REQUESTRequest to ServerTEXT

GET / HTTP/1.1
Host: 34.170.146.252:7724
User-Agent: curl/8.20.0
Accept: */*

RESPONSEResponse from ServerXML

HTTP/1.1 200 OK
Server: Werkzeug/3.1.8 Python/3.14.2
Date: Tue, 08 Sep 2026 13:44:46 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 295
Vary: Cookie
Set-Cookie: session=.eJwlyzELwjAQhuG_cmRxcagUEbqJk6uDk3Cc5msNxlzJGaWU_ncjbi8PvLN7wkwGuM6d1GAkGZTh15d0Dhrx-ss1FlQ6rt6ge_AeiYT6KEO1X9bTgibqNdOkpaN9HOUm80GbxwbGklu2D9odS_K81QrgqSmLW77kUS59.aqARTg.S-77ysnkXnPOMSIRQ0T1y8rv2Q4; HttpOnly; Path=/
Connection: close

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Message for You!</title>
</head>
<body>
    <p>I've got a message for you.</p>
    <p>It's hidden somewhere around here...</p>
</body>
</html>

We have the session in response, now we can use the tool "flask-unsign" to get the decoded message.

Decode the Sessionbash

$ flask-unsign -d -c ".eJwlyzELwjAQhuG_cmRxcagUEbqJk6uDk3Cc5msNxlzJGaWU_ncjbi8PvLN7wkwGuM6d1GAkGZTh15d0Dhrx-ss1FlQ6rt6ge_AeiYT6KEO1X9bTgibqNdOkpaN9HOUm80GbxwbGklu2D9odS_K81QrgqSmLW77kUS59.aqARTg.S-77ysnkXnPOMSIRQ0T1y8rv2Q4"
{'message': "Roses are red,\nViolets are blue,\nI've hidden a flag\nIn a session for you: Alpaca{Co0k1es_ar3_swe37_and_5o_are_y0u}"}

04 · FLAG

Flag

FLAGFlag confirmat

Alpaca{Co0k1es_ar3_swe37_and_5o_are_y0u}