GAMEFREAK PRESENTS
POKEMON
CTF EDITION
TRAINER CARD FORGERY VER.
🔴
Professor Oak needs help.
But the lab is locked...
Can you get inside?
[ PRESS START ]
© POKEMON CTF — check the source code
;)
~ PALLET TOWN ~
↑ enter oak's lab ↑
▼
???: Don't go in tall grass
without a Pokemon!
Oak's lab looks locked...
maybe you can find a way in.
🔬 OAK'S POKEMON LAB 🔬
👴
Ah, a new trainer!
Welcome to my lab.
I study Pokemon...
and access control.
Restricted research
is for PROFESSORS only.
NOTICE BOARD
─────────────────
All trainers must
register to get an
access token.
RESEARCH MEMO
─────────────────
Access tokens have
3 parts: header,
payload, signature.
[tap to read more]
YOUR TRAINER CARD (JWT)
your token — 3 colour-coded parts:
HEADER (red)
PAYLOAD (green) — your data
SIGNATURE (blue) — server seal
decoded payload:
RESTRICTED: Professor's Lab
requires role: "professor"
your role: "trainer"
ACCESS GRANTED
PROFESSOR'S LAB
👴✨
Prof. Oak: "Impressive work.
You forged your trainer card.
That's exactly the alg:none
vulnerability in the wild.
Here's what you came for..."
PROFESSOR'S RESEARCH FILES
[ ACCESS GRANTED - CLICK TO OPEN ]
▶ click to open
next: load the GBA file.
find the signboards inside the lab.