GAME BOY ADVANCE SP
PWR
TRAINER: TRAINER
GAMEFREAK PRESENTS
POKEMON
CTF EDITION
TRAINER CARD FORGERY VER.
🔴
Professor Oak needs help.
But the lab is locked...
Can you get inside?
[ PRESS START ]
© POKEMON CTF — check the source code ;)
~ PALLET TOWN ~
🏠
YOUR
HOUSE
🔬
OAK'S
LAB
🏠
GARY'S
HOUSE
↑ enter oak's lab ↑
???: Don't go in tall grass
without a Pokemon!

Oak's lab looks locked...
maybe you can find a way in.
🔬 OAK'S POKEMON LAB 🔬
👴
Ah, a new trainer!
Welcome to my lab.

I study Pokemon...
and access control.

Restricted research
is for PROFESSORS only.

NOTICE BOARD
─────────────────
All trainers must
register to get an
access token.

RESEARCH MEMO
─────────────────
Access tokens have
3 parts: header,
payload, signature.
[tap to read more]

TRAINER CARD SYSTEM
POKEMON LEAGUE AUTH v1.0
A trainer card = a JWT token.
JWT = JSON Web Token.
Format: HEADER.PAYLOAD.SIGNATURE
Each part is base64url encoded.

After logging in, inspect your
token. What is your "role"?

Professors have more access
than trainers. Hmm... 🤔
YOUR TRAINER CARD (JWT)
your token — 3 colour-coded parts:
HEADER (red)
PAYLOAD (green) — your data
SIGNATURE (blue) — server seal
decoded payload:
RESTRICTED: Professor's Lab
requires role: "professor"
your role: "trainer"
TOKEN FORGE
paste forged token here:
ACCESS GRANTED
PROFESSOR'S LAB
👴✨
Prof. Oak: "Impressive work.
You forged your trainer card.
That's exactly the alg:none
vulnerability in the wild.

Here's what you came for..."
PROFESSOR'S RESEARCH FILES

[ ACCESS GRANTED - CLICK TO OPEN ]

▶ click to open
next: load the GBA file.
find the signboards inside the lab.