WebDecode — picoCTF Write-up | Finding and Decoding a Hidden Flag

Introduction

While practicing web exploitation challenges on picoCTF / CyLab Academy, I came across a beginner-friendly challenge called WebDecode.

At first, the website looked very simple. It had only a few pages — Home, About, and Contact — and each page contained a small hint encouraging me to keep looking.

I explored the website normally for a while, but there wasn't much functionality to interact with. Instead of overcomplicating things, I decided to inspect the page more carefully.

That simple decision eventually led me to an interesting hidden value inside the HTML.

Challenge: WebDecode Category: Web Exploitation Platform: picoCTF / CyLab Academy Main Concepts: HTML Inspection, Base64 Encoding, Information Disclosure

Exploring the Website

After launching the challenge, I started navigating through the available pages.

The homepage displayed:

It was obvious that the challenge wanted me to explore the website.

So I followed the hint and checked the other available pages.

Checking the Contact Page

Next, I opened the Contact page.

It displayed another message:

There was no form, input field, or other interesting functionality on this page.

The website was clearly giving hints, but nothing useful was directly visible yet.

The About Page Gave a Better Hint

I then moved to the About page.

This page contained a much more useful message:

This immediately caught my attention.

Instead of continuing to search randomly through the visible website, I decided to follow the hint literally and inspect the page.

Inspecting the HTML

I opened the browser's Developer Tools and went to the Elements tab.

I started checking the HTML structure of the About page.

Inside About elements, I noticed an unusual custom attribute named:

notify_true

Its value was a long string that looked something like this:

cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRf...

This looked suspicious.

It clearly wasn't normal text used for styling or page structure.

Because the challenge was called WebDecode, I suspected that this value might be encoded data.

Recognizing Base64

Looking at the string, its structure looked familiar.

Base64-encoded data usually contains characters such as:

A-Z

a-z

0-9

/

and sometimes ends with:

=

The hidden value matched the general appearance of Base64.

This gave me a strong reason to try decoding it.

What Is Base64?

Base64 is an encoding method used to represent data using printable ASCII characters.

For example:

Hello

can be Base64 encoded as:

SGVsbG8=

And decoding:

SGVsbG8=

returns:

Hello

The important thing to understand is:

Base64 is encoding, not encryption.

It does not provide confidentiality because anyone who obtains the encoded value can decode it.

Decoding the Hidden Value

I copied the suspicious value from the HTML and decoded it as Base64.

After decoding, it revealed:

And that was it — challenge solved! 🚩

There was no need for brute force, injection, or any complicated exploit.

The solution was simply about following the hints, inspecting the page carefully, recognizing encoded data, and decoding it.

Understanding the Challenge

The complete flow was:

Open Website → Explore Pages → Check Contact Page → Open About Page → Notice "Inspect the Page" Hint → Open Developer Tools → Inspect HTML → Discover Encoded Attribute → Recognize Base64 → Decode Value → Flag 🚩

What I liked about this challenge was that it encouraged observation rather than immediately reaching for advanced tools.

I checked the website normally first and didn't find much. The About page then gave me a useful clue, so I inspected its HTML instead of randomly trying different attacks.

That is a useful habit when approaching web challenges.

Why Could We See the Hidden Value?

The encoded value wasn't displayed as normal text on the website, but it was still present inside the HTML sent to the browser.

That creates an important distinction:

What the webpage displays ≠ Everything the browser receives

A user can inspect client-side HTML using Developer Tools, regardless of whether a particular value is visibly rendered on the page.

So simply hiding information inside:

HTML attributes

Hidden elements

JavaScript variables

HTML comments

or similar client-side locations does not make that information secret.

Encoding Is Not Security

Another important lesson from WebDecode is that encoding should never be treated as a security mechanism.

Consider:

Sensitive Data → Base64 → Encoded String

The resulting value may look unreadable at first, but the original information can easily be recovered:

Encoded String → Base64 Decode → Sensitive Data

No secret key is required.

This makes Base64 useful for representing and transferring data, but not for protecting confidential information.

Real-World Security Lesson

In real applications, developers sometimes accidentally expose sensitive information in client-side code.

Examples could include:

• API keys
• Internal URLs
• Debug information
• User information
• Tokens
• Configuration values
• Hidden parameters
• Comments
• Encoded secrets

Even if this information isn't visible on the rendered page, an attacker can inspect the application's HTML, JavaScript, network responses, and other client-side resources.

This type of issue can lead to Information Disclosure.

How to Prevent This

Applications should never send sensitive information to the browser unless the user is authorized and actually needs that information.

Developers should not rely on hidden HTML elements, custom attributes, comments, or Base64 encoding to protect secrets.

Sensitive values should remain on the server whenever possible.

Production applications should also be reviewed to ensure debugging information, development values, credentials, and unnecessary internal data are not accidentally included in client-side responses.

A simple rule is:

If the browser receives it, assume the user can inspect it.

What I Learned

This challenge reinforced several useful web security habits:

• Explore the application before trying complex attacks.
• Read every hint carefully.
• Inspect HTML when the application suggests something may be hidden.
• Don't focus only on what is visibly displayed.
• Custom HTML attributes can contain interesting information.
• Learn to recognize common encoding formats.
• Base64 is encoding, not encryption.
• Client-side information should never be considered secret.

Most importantly, the challenge reminded me to stay attentive and curious.

I checked the website normally first and didn't find anything obvious. Instead of trying random payloads, I followed the clue on the About page, inspected the HTML, and noticed the unusual encoded value.

Sometimes that small amount of curiosity is all you need.

Conclusion

WebDecode was a simple but informative picoCTF web exploitation challenge.

I started by exploring the Home, Contact, and About pages. Nothing obvious appeared on the visible website, but the About page specifically suggested inspecting the page.

Inside the HTML, I discovered a suspicious encoded value stored in a custom attribute. Recognizing it as Base64 and decoding it revealed the flag.

The biggest takeaway from this challenge is:

Never assume information is hidden just because it isn't visible on the webpage. If it's sent to the browser, the user can inspect it.

Connect With Me

LinkedIn: https://www.linkedin.com/in/affanhaxor Instagram: https://instagram.com/affan_haxor

Follow me for more CTF write-ups, web security labs, and AppSec content.