Burner972021’s amazing blog!

You know, I thought this would be a pretty trivial challenge considering

Description

This is my amazing blog! It contains a lot of interesting articles about various topics. I hope you enjoy reading it.

https://burner972021.github.io/

solve

given the website, it shohuld be trivial to find the published git repo.

the flag isn’t on the rendered site or the git repo (although there are quite a few fake flags). there’s a hidden staging deploy by a cloudflare worker in one fo the commits. to get in we need two things, both deleted from git history in separate “cleanup” commits

HEAD only has .github/workflows/deploy.yml, but looking at commit history either through git log --all -p -- .github/workflows/ or just looking at the web version, you can find preview.yml, which was added in add preview workflow for staging and removed in refactor: del unused workflow. this leaks the worker url https://120279renrub.caoxizhencaoxizhen.workers.dev and that its locked behind an X-Preview-Token header fed from $.

players are expected to look through commit messages to find suspicious commits that might contain secrets:

a comment added in warm stage cache on load, removed in clean up debug logging:

// fetch('https://120279renrub.caoxizhencaoxizhen.workers.dev/', {
//   headers: { 'X-Preview-Token': 'pv_live_8f3c2a1d9e4b7c60' } });

_layouts/default.html history also contains pv_live_aa00deadbeefcafe, but its named __ANALYTICS_KEY, not PREVIEW_TOKEN. the workflow says the secret is named PREVIEW_TOKEN. so only pv_live_8f3c2a1d9e4b7c60 from post-filiter.js works.

curling it with the legit token:

curl https://120279renrub.caoxizhencaoxizhen.workers.dev/ -H 'X-Preview-Token: pv_live_8f3c2a1d9e4b7c60'

flag

sctf{dont_commit_your_secrets!}