Today's special: gummy bears
\n", "\n", " \n", "\n", " \n", " \n", "\n", " \n", "\n", "'''\n", "\n", "print(f\"✅ Loaded {len(target_html)} characters of HTML.\")" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "## 👀 Step 2 — Take a quick look at the page\n", "\n", "Before we start hunting, let's see what's actually in it. Press ▶." ] }, { "cell_type": "code", "execution_count": null, "metadata": {}, "outputs": [], "source": [ "print(target_html)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Look closely. Can you spot:\n", "\n", "- 📝 The 3 `` comments (including a FLAG)\n", "- 👻 The 2 `` lines (sneaky!)\n", "- 🚩 Three `FLAG{...}` strings hiding in different places\n", "\n", "Now we'll write code that finds these **automatically**.\n", "\n", "---\n", "\n", "## 🎯 Mission 1 — Find every HTML comment\n", "\n", "HTML comments look like this:\n", "```html\n", "\n", "```\n", "\n", "The browser doesn't show them, but **you can read them in the page source**. Developers sometimes accidentally leave secrets in comments.\n", "\n", "The cell below uses a **regex pattern** `` to find every comment. It's already written — **just press ▶**." ] }, { "cell_type": "code", "execution_count": null, "metadata": {}, "outputs": [], "source": [ "# Pattern: means \"\"\n", "# The re.DOTALL flag lets the pattern cross newlines.\n", "\n", "comments = re.findall(r\"\", target_html, re.DOTALL)\n", "\n", "print(f\"📝 Found {len(comments)} HTML comments:\\n\")\n", "for i, c in enumerate(comments, 1):\n", " print(f\" {i}. {c.strip()}\")" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "### 🎯 Mini-challenge (optional)\n", "\n", "The code above prints ALL the comments. Can you change it to print **only the comments that contain the word `FLAG`**?\n", "\n", "Press ▶ on the cell below to see one way to do it." ] }, { "cell_type": "code", "execution_count": null, "metadata": {}, "outputs": [], "source": [ "# Only show comments that contain the word \"FLAG\".\n", "\n", "comments = re.findall(r\"\", target_html, re.DOTALL)\n", "\n", "for c in comments:\n", " if \"FLAG\" in c:\n", " print(\"🚩\", c.strip())" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "---\n", "\n", "## 🎯 Mission 2 — Find hidden form inputs\n", "\n", "Forms sometimes have **hidden inputs** — invisible fields like:\n", "```html\n", "\n", "```\n", "\n", "The browser doesn't show them, but they're right there in the HTML for anyone to read. Developers sometimes hide passwords, API keys, or user roles in these.\n", "\n", "**Press ▶** to find them in our page." ] }, { "cell_type": "code", "execution_count": null, "metadata": {}, "outputs": [], "source": [ "# Pattern: