Loading
The Vidyapeeth College Portal team saved their student login page for an offline security review. Before the review starts, a developer left a note in the page source: an old session token was split into two parts for safety.
You are given portal.html, a copy of the login page. Your job: recover the token. One half sits inside an HTML comment near the top of the file, encoded in base64. The other half sits in a hidden form field that never shows on screen. Decode the first half with the Toolkit decoder, join the two halves in order, and wrap the result in the flag format to get the flag.
Open the file in a text editor, or use View Source in your browser (right-click, or Ctrl+U). This is how real testers start: the rendered page is never the whole story.
This challenge only. All names, addresses and data are fictional. Do not test any real system.
Stuck? Open hints in order: a nudge, then the next step, then an explicit pointer. Costs are taken from this solve's points.
Sign in to open hints.
Sign in to submit a flag.
Sign in, then solve this challenge or give up on it to read write-ups.
Files are safe practice artefacts made for this challenge. Open them on your own computer.