Secure Flag Hiding Application

A single-page "Secure Flag Hider" claims it leaks nothing important. The flag is sitting in a static JavaScript file the page loads, as a plain comment. No auth, no API, no obfuscation.

Solve

1. View the page source. The only dynamic resource is a script tag:

   <script src="/static/secret.js"></script>
   

2. Start the instance, then fetch that script directly:

   curl -s https://<target>/static/secret.js
   

   The flag is a comment in the served file:

   // SVIBGR{@lwAys_Ch3ck_Th3_S0urc3s}
   

Flag: SVIBGR{@lwAys_Ch3ck_Th3_S0urc3s}