for0For

Level

medium

Type

Forensics

once it have been out it is marked for the end, if it was 404 that doesn’t mean it is not useful, the most useful thing are the things that we don't have so we can have the curious to achieve

Open and inspect the log file, Notice all GET requests return 404 errors, Paths appear as /9zkgvp5mmde9e4rr6u7j with random-looking characters.

127.0.0.1 - - [10/May/2025 11:19:36] code 404, message File not found
127.0.0.1 - - [10/May/2025 11:19:36] "GET /5d0ostj4p8q30y2bvyez HTTP/1.1" 404 -
127.0.0.1 - - [10/May/2025 11:19:36] code 404, message File not found
127.0.0.1 - - [10/May/2025 11:19:36] "GET /Y3eou4ggc0mik2o4af7bp HTTP/1.1" 404 -
127.0.0.1 - - [10/May/2025 11:19:36] code 404, message File not found
127.0.0.1 - - [10/May/2025 11:19:36] "GET /Undf99hjfxfo8tv6cq4rg HTTP/1.1" 404 -
127.0.0.1 - - [10/May/2025 11:19:36] code 404, message File not found
127.0.0.1 - - [10/May/2025 11:19:36] "GET /r4z69zqmvvjq1dy28wfy HTTP/1.1" 404 -
127.0.0.1 - - [10/May/2025 11:19:36] code 404, message File not found
127.0.0.1 - - [10/May/2025 11:19:36] "GET /Ctxm3r428ocbqn00optz3 HTTP/1.1" 404 -

Extract all paths from GET requests, Use the following command to extract everything after GET /:

cat logs.txt | grep -oP '(?<=GET /)[^ ]+'

grep: searches text using patterns.
o: only print the matching part of the line.
P: enables Perl-compatible regex.
(?<=GET /): a positive lookbehind to match text after GET /.
[^ ]+: matches one or more characters that are not a space (captures the path).

5d0ostj4p8q30y2bvyez
Y3eou4ggc0mik2o4af7bp
Undf99hjfxfo8tv6cq4rg
r4z69zqmvvjq1dy28wfy
Ctxm3r428ocbqn00optz3
Toao7v6ihqvxg78j6ofdk
fev7bgjw6ncvca5x9kkz
Fdkh6b95oh4xopq790fat
{02no3hykd9r0c5ge69hn
pote2jus0fz04235mn1e
p3c9ujfbxp2djzyzhrre
4cdpzmlwa4sxi8vw1dxe
9zkgvp5mmde9e4rr6u7j
seapesxmuuts9hf0zhvni
ndpqge4w4ouaz6x8jbniw
8ynkydmgk14z8gmwmdpg
9nhlqodfiff8p8afvio9
nz56j46403wyv7s24k7c
cwr57m8wbj406ual1s5r
i8sbl3hup0cz9zht5vkaf
6m1cofab9y1d6w8qof5o
fejnxv5cwy14nirngte10
f06uirtcrd0vteqctanlu
tpmwmy8xa4sf9m4fee7b
ekpncupckxap4ai0qwyij
dvllf4wusotrh919twhuz
ir3p3h8jc8x9bttc20je
_9x4tkmztz0okjznj2bob
80plxfo8nsb2b76fhorj
pxlqeopxjmo0zlfuui11i
aa9jmp2da30o08tqjn34y
6eyib0onvslfjaof3eux
cnzq9c6oaagiyhfqey16u
keprllviqzdf87n6ab04c
euoho3wgqxkpdrqz79nn0
stamvowdr9gd947dskery0
pcvmtr22b9khe4fec8a4
_84peve5dy5bpegh6bhnn
u46i4epfga0fj2t56i88m6
96j3opn8gcu0hgywn9g5o
6qhw0ai790jaio2bhcdq
rmzqr9lwq0xmx64785o0s
3uegb356brt82sgpuccub
qzyha60q17uab2nkpmu4
07ilbxj4c09uvgjqvc2x
eyblzdf4vocbzw7izg6e
j3cm7ick141fbg7q3phv
c78mnptsz6csly995fha
i6bp052b2rvtitnbav5u
0f2fvdvfvskhbgbkl1md
47s618efw9mzw2rwwrc1
gf4yp2tcsx0crw7ykwwd
h4v672xxhu6yo19aduhl
xykyzjl0q0055pwzossk
xktk5qpfjhjyllrozp5c
q2ikwyqp5i3r2f3i1ef6
c1olqf0hhtpgcfjoeotp
x0engxld0gje1khghlrk
jawwlhstnhxre1vzuwn6
zs4g6qy3f8ajyklvy8zv
c3cssxxdizplt6owm492
zd7z8n35yehneutwdwj8
uix4zzo453kzkd4i4zzy
rxs5jznztsijw6t3nmvi
da022d9f2nt1wjhl2b7f
pu9vwk3ij63g0kdohk36
tifis9ttyiv1pw1s1i3u
n4ba4ma97dc4ttsznni1
yjzps35b6pq2fv92whew
84utcdq84k4torc5cxku
9rfnpiogn5qp2jntwglx
pwybx527i57hf42683ai
zaw2ou5fq9los4wzmu5m
6ysafvn8ys7qjg691lh9
64u4jqkf16jr2yfv2p0c
qyvdtd0iihz2bjjdt9k4
uziluz4j4v7oevwsazd7
l8ddbu97ubjypw2ukh1o
fg5rsxf1y4stic7mxv71
5w0v2plz39mpu6nw5u1b
va3zwklgn71nk2jvmmdi
a12kfpmw1ikbhzvb04u4
k5c2lgecrgmu21e544af
xsu7vgc9ihstvohjjfra
atpb7sstg8hsrha2112s
trn4fqujugbxj2xphh6o
x1heugvbllkfic5b9x26
w5b9eidhtu8bh5hc6bbk
n42xjrdpkzabvwl1q039
hgf9q8iqpaaom4zqtfdk
akdvkpdwqrdo51tvft0f
mxwdgm7eosa9wklej3wc
cdi1v96ep2g8rse5heqn
lfr0q3r1ry4asf9dc5xp
tvr7rioqw0weu866s7ag
rgio0sh1sco013751a99
ql7dzw0r46ai4smd5i5c
2cb0ss8znhe8q0yj5446
oreq452wl846q2hb7xd1
3sc1jxlegzs3fdd0v9mi
v5k2tx8gr8ok10sq556k
pk4eosk1ezd1qg1c4b9o
10w7181x8daglatdhqr2
4zrpn2681i5csk0h37za
wutboyyfuyyko5qgy7jg
lsgxnb3yls6ndp838njd
jvjv3rzizro10po1n2ho
ykr013hmrcheadu9bghl
oaawg53dpxg79cy02kgq
o1klpwirf8iwkh43zt4r
k4df7l8qma841nn55meh
s8lz1mp8xi4dborqtz4w
5uxmmnwmgdmoybgoci4c
f8yo7ozn97e5dq9sixng
p8bovg8eozyjs333n9jy
lcabkot9u94jvr33709n
f0uhand91f16ffyp300w
16095xnsrb7icattya6u
3gc4r6d6fydujhn2q7ci
n2axbq17oxojpbygurf1
lm37ut08tbkb8sn8skli
i8zagwnhcgudgcjxw74a
kqzoihi1uq4a3rv28t2z
tpkc4hki2okzhz82bses
jhnzg8wyrfutc9bofdul
8r3isxal7fppnr4m6ct4
fif61lk12fjxhgwisdxo
tk6rfxyqoo01t5zehl3k
894pn09pjw3925kfat0q
o2ijwkq3zrjljjvydalw
1ppll2ow56ci7dw3dnaq
np91od00g707ko3dj1ao
a5rvr1fmclzu1k89m7xu
dq0uip4lv2ja6h2u3u7b
ntgao0noa3arxuovsfz2
a96txuu6va6e0wtttlkw
4mikwhvrc6n1n7zb9bf0
7ga7ql3c1uevabhwx1zg
2z5tx75ep4xkqwdgqqzf
ntem5ofvj10yp4cq1e1e
40p5apwy9eznf34m45o7
34r9vzhcobtqn41hmuev
x2i3ybsqdll6hh500afh
kl0zbh2ijitgon62jnzx
yqovmzudkoabj25q7gji
2sks8muc8qv6oofa2287
3v7kiuekkhh7ls7bug1l
feswdf4nnf21rsrpa9pw
r317qsfkxhzqtyvqulxt
g25iy9x34p0hrjbf37py
7unr1vh4oc6iu2cy1cx3
0zv021j7b5os0ue29us0
wuhzdi66e60nyaq4ffaw
bjn0l16cb3hglso7jcs8
qs4y5nwsy0tod4v77i6t
wti92p9odbxyu7dpqnd9
7dc9wwbo2zgftx28wbcp
oqr3qe03aspjnv0uuwbr
cepwevpyd2sdyd5780gy
r41t730d45sz1yp45sig
2pyhp8xif2l535slpcov
g3uqc7jd0qeckjmax5bo
55yvblpgvoh98udpvfub
iq0peuwk9cqlcbvzuqgs
fnl6thhte9ie6i6w8g8x
vbtqrepy55l4ncg6vaoj
fk4tgtyqismh352ll3f4
ejlzv65a6jt2rlyyac04
4ak50z9yie7ig5ar5rfg
6bqq4ka4oktmjdxjmbs9
aeqwbmzkh9m0axovkspy
8tctk0qwt1b7ubetdos1
065wm27nxi1132g9dp4c
8a0o2igp2l17a92tn2vj
nmsguplofpe89kl3puew
qxwl7ouc50wh1p8vv475
gi71ejjxyrz5r8kxy7rk
0e3pn7dhl42lyrlp2mvl
lo7hyyzripu7y394u0p5
5cs6nezimnqnelrwmrqq
o47m4of7sf16rxut5wt2
xyqllengkn28fyuyk9kx
ifsg75i424ums5tm2lbt
htuv11co4111iwrf99di
wtjwljt0v285c9x2bg0k
kd660rqa06vujkmf27ul
lyf8veu0a87k170v871i
9vgct9hyyfqjxb28np7e
oxiqgnupop6gxlkc1f8e
pkc8sapg7r3qpkzk2m66
m1xdridcoruep7m2havz
65awtz5y0w2oqkl8faur
tjskb7ekb7mzgjq58750
ajgf5g9qlv0g35q9at7h
ypbzu829k9jscngstq11
xr7aychmlxw7dqtwxm0t
kpytvf75dgj7lma9vwnw
uermwwrs4erx8sbs95p2
qzsu4mhk2o46z7x9zho2
uqhqbdmdw0yy0bxe9o2b
6fe1rr6kvwrnwmr3esdh
losashhxrly8l8vyjw8b
8rvm7ax6dhews15p8m24
m8hpj3fz0etn3vw09n7w
cjy9x28l3dcgmo1euxhj
coob8jeln00l6238fyey
gwedy086kzwroomy2f7i
ndva8hx73zf3yzldncm6
cebfqnr1eybb3a33y9hx
89u3c4onqaor51aqtdt8
zb4feh5lsxw86lzmotqp
op9255gcn5udurckix6r
yf8tlntvqjuc4hnejv3c
qbvqkb9ep4j50sprtuzo
plnwlolbb0l7b9sn3k7a
d9drl2kapedb89qwsvpi
cnq2oyv6f3rsx5cuhy0s
mjnf6cw8laxck25lu8kv
cnaulyp1yz2xf8v1d7pj
0m0rvr5tqbnbypsxxjxu
ig7c2wqhkin7jevvqhrk
p4hbekhy43e6xsgqkktr
gkb7f6dptu7ucg7vho1b
rapg3gyiekyvamfii0uc
crezpzcqmwr08phuw72z
bdt2rtddycsxieenel5y
iksmleiw8by43iwgvtzv
tqv5ojyo7e0txdguiyuy
krv7ivb8wyf6ca2jf2f1
k3ac6jvn8kq4ow1naify
e78m5n5r1hln8hnxd9fa
lcyr6byp8hfg6cnv1ary
cbid32zht55km0d85wkc
3xxhf6jj670n1ts5b9va
uue1tpgyo7fqu83fdq19
d3ev211fm9ux24w2tq9y
pjhds2bdedsxrpm89mra
znhtyixcbujkhysbtmuk
uck961j7fmvqfh2lsgxx
iww0bsf1f6b1lu5zkk7p
brqjhg35le9xbq1idrp3
26nig9jg13xct4pjqfhr
ddtrffxjz4zfiqn0ls5f
rl33croaejnpcxnslgz2
ixlid5s4hnian2pwqa34
fk4buo5uzidq3xw02dmy
i4jq6leako7n3c6mbpdg
oebc2u9003q3xbql5kel
zq3p9296v21wn547ld5b
scok897z6ucgojgqpi9p
jynk6fhiux1nqs3602qs
fia9ty5ro0y9pqmway02
wat8wa7u0z09otcg9o27
zsi3v9vplp3nl27xtkh8
3qneiybhcvggz8loefmy
512j6b26z7u4u4xsw3n2
2t8h9nf6ymwi4hecuwv5
pzi9glk2rydntq0iw7gx
yn31c6v9i9b78qnew3e0
ufaonj89qrrv3pmomfti
usgb149rsqoxreo3ebtf
cevm33fgohxuwe0ww3nf
r6z0e679wkqllv0rljrn
iuw1n34kd6v9n4imzwo6
2zw7vcs3oejgkxc6to4r
voyrxo2pgqnlkm4gcdu0
dce9u4g0gahq8c50bzka
3gec6ns1i6o9ql1auefi
wrc8gd90f6hcd4onj2x1
d0u6t1pomq6f7x03hvps
x2t8nc106a2jobwduc7g
m340rbt91cu4ef8tlgy1
vogoqe4v8plprdh4flor
xqmwx2hjivflzu2f9ilz
g8on0107gjvu01pmybwl
yqnhs78co2f4wcftbmfe
f2yo7owaltx5skxan9sk
ej44wgtp17xos04ajhr9
uyj5xy1ppt443rjy4zl7
n96evspvuqvamxvlx7kx
lwwl0e3p1cf9r687wjh3
a1nbcra54x58xlycszcn
sbo9mkle2bdzdn0385ag
4xx7vu5rvm6t015avqpb
fze4nya63jzmdosqumvc
5ht73q1llz3fca75j5tk
d0tbe1iv90knnk50no9u
n5wo5zsgdb7ehtmpmrha
e7tsm8fzvaef4y1m61pg
qvcuuxs23av9t5hvqloz
r2ys4ujhunjskck5vprz
v2y01xsnhf0jpro3z983
06c7cj8qfpyibvjf577v
7730cs6vuck7fj3xgdp7
poapx975247nlwrgezo2
ywq5aiontvj4wrv5vuqj
xaa6we9djiomvby1mbd8
s3ylmzwva8v6jlfclmfe
5r7wsnx11vrvzvpmn2ef
17ik5jy4dfpsxjt3anm3
3jat78tc20bu6q9emu92
vwsklu1x6nqa66gk2n1t
vifvjnte7xn99hi6xpm8
6yex2mph7cigs62u3mk6
d96a6bvjfs0cpt7aa6py
phfgybvra7vv3en5a4b5
nmx5an69qyo2cmqvs1cf
nwbpv309hby0fd5mbox2
nzcpn4iw8ctepvbzcqnb
h2xuk0zlzfeawjven04u
aiagfjgbfqwpf928xsn4
n52glawazcso5emsvwkw
edted9c9a4jmok8cqehv
z0bt0ayxaqmkltvmv8gi
tzqan72vjxhbe1v2zdul
mkhwvhlt0i5bpadfmwon
k4auyvbcvjek2w4o4dwl
9t8qmmp5e823vc24qot5
e3p0vaicu85huok1a1v4
qyiadgyf02njqhhnh2my
6t3bchw9ad768b1b1e1p
896lxuydbe913e1z76rs
xpcb38d6wktd3tlt3j8i
i01lvmmdujhe43qtfmln
qd7ook0md11e4z4lxiqu
vkqeahjbe27ypsmagedi
3zgtegdkcg16tr9bp2dw
vz3ifgsyo6dy2tgxum3q
kuiywggiib38lumliet6
8p88b9xo8t4m3axxi87n
00gw5ngt2cojhyoedjwy
6j08myvfqczi806hx7fw
v3y8w5gh41mzvq7z5iz9
cmsw6xdh55pmv55zu8no
mj1ygkwgq87vhsuqnby0
m7t7ocygq46a5e1v1fht
0f1vaysmoj9xhbz7ghb9
xncezyoyfwr3npytu5o6
zaz5lwd1zwas3g5geusr
p8n00z9ygtet83un5mqw
z9lp3vhmi3actxy7kcir
is7tf7ftvob799uhxjll
jr7zjrn3bibrljs7ik9d
hm6z4r6m0igb3w874fpm
av0380gedfi8c9rpu9t9
6jz0pt4wovz7k4cuzz1x
utjzt72b579jfs5if3lg
hyqzju34xbn27ldkwfdz
14j590vc4inadd09r3pp
z57ifpnqkzxogcmg44cs
ljp4pl28fg2s2fll94ai
zqcdkpunhretxkjsv3bl
eb5f32gi1885ptup8aoy
ccmhfgmkqinblut5yx58
3mb2xpzwhgsbjl8u45kj
joqz6rw2ltaklb21x8fa
vr9fvue127sux9gandk4
ne4i6jjd6960vtfydb15
g797bnukl2fccihit5av
d1qx4p7hnccs7wgr3js0
ppm2otpmgpufnfv10piz
7vy6vtfgfm29jnbqntyj
r41jyjms823o4nh0n7kr
197zdsg8d23aio2y6nwc
hbll26v8aiow0wk54hj0
5d0ostj4p8q30y2bvyez
3eou4ggc0mik2o4af7bp
ndf99hjfxfo8tv6cq4rg
r4z69zqmvvjq1dy28wfy
txm3r428ocbqn00optz3
oao7v6ihqvxg78j6ofdk
fev7bgjw6ncvca5x9kkz
dkh6b95oh4xopq790fat
02no3hykd9r0c5ge69hn
pote2jus0fz04235mn1e
p3c9ujfbxp2djzyzhrre
}4cdpzmlwa4sxi8vw1dxe
9zkgvp5mmde9e4rr6u7j

Identify strings longer than 20 characters, To extract only the strings with 21 or more characters:

cat logs.txt | grep -oP '(?<=GET /)\S{21,}'

\S: matches any non-whitespace character.
{21,}: matches 21 or more such characters.
This ensures we're only grabbing long request paths (21+ characters) that might be relevant.
You'll observe most results are 21 characters long, with a few being 22.

Y3eou4ggc0mik2o4af7bp
Undf99hjfxfo8tv6cq4rg
Ctxm3r428ocbqn00optz3
Toao7v6ihqvxg78j6ofdk
Fdkh6b95oh4xopq790fat
{02no3hykd9r0c5ge69hn
seapesxmuuts9hf0zhvni
ndpqge4w4ouaz6x8jbniw
i8sbl3hup0cz9zht5vkaf
fejnxv5cwy14nirngte10
f06uirtcrd0vteqctanlu
ekpncupckxap4ai0qwyij
dvllf4wusotrh919twhuz
_9x4tkmztz0okjznj2bob
pxlqeopxjmo0zlfuui11i
aa9jmp2da30o08tqjn34y
cnzq9c6oaagiyhfqey16u
keprllviqzdf87n6ab04c
euoho3wgqxkpdrqz79nn0
stamvowdr9gd947dskery0
_84peve5dy5bpegh6bhnn
u46i4epfga0fj2t56i88m6
96j3opn8gcu0hgywn9g5o
rmzqr9lwq0xmx64785o0s
3uegb356brt82sgpuccub
}4cdpzmlwa4sxi8vw1dxe

Focus on 21-character strings, Since most are 21 characters, and only a few are 22, reverse the original logic, Ignore the less frequent (longer) strings and focus on the common length (21):

cat logs.txt | grep -oP '(?<=GET /).{21}(?=\s|")'

.{21}: matches exactly 21 characters.

Y3eou4ggc0mik2o4af7bp
Undf99hjfxfo8tv6cq4rg
Ctxm3r428ocbqn00optz3
Toao7v6ihqvxg78j6ofdk
Fdkh6b95oh4xopq790fat
{02no3hykd9r0c5ge69hn
seapesxmuuts9hf0zhvni
ndpqge4w4ouaz6x8jbniw
i8sbl3hup0cz9zht5vkaf
fejnxv5cwy14nirngte10
f06uirtcrd0vteqctanlu
ekpncupckxap4ai0qwyij
dvllf4wusotrh919twhuz
_9x4tkmztz0okjznj2bob
pxlqeopxjmo0zlfuui11i
aa9jmp2da30o08tqjn34y
cnzq9c6oaagiyhfqey16u
keprllviqzdf87n6ab04c
euoho3wgqxkpdrqz79nn0
_84peve5dy5bpegh6bhnn
96j3opn8gcu0hgywn9g5o
rmzqr9lwq0xmx64785o0s
3uegb356brt82sgpuccub
}4cdpzmlwa4sxi8vw1dxe

Extract the first character of each 21-character string, These first characters seem to represent part of the flag.

cat logs.txt | grep -oP '(?<=GET /).{21}(?=\s|")' | cut -c1 | tr -d '\n'

cut -c1: Extracts the first character from each line of output.
tr -d '\n': Removes all newline characters to combine all first characters into a single line.

YUCTF{sniffed_packe_9r3}

Flag: YUCTF{sniffed_packe_9r3}