Ping App #

Deobfuscation of the Flutter application code>

Deobfuscation of the Flutter application code #

I gave the main.dart.js script to https://beautifier.io/ to get a minimum readable script.

To try to find the application code, I searched for one of the strings displayed on one of the tiles, here I searched for Check me out :

Looking at the surrounding functions we find several interesting functions:

We find the one referring to the Ping site, and two functions redirecting to /1 which is the URI in case of error.

A little further on we also find these functions :

We find 2 new routes /sike and /fc6b0283-bc19-447e-9d0e-42cfe745c547.

/sike seems to return the same error as /1, so nothing of interest here. On the other hand /fc6b0283-bc19-447e-9d0e-42cfe745c547 returns the challenge flag! Victory !

PingCTF 2022 - This article is part of a series.

Part 1: This Article

Part 2: PingCTF 2022 - Ping Game