Pascal CTF

Tue, 03 Feb 2026 00:00:00 +0000

Web Challenges

JSHit

This was a straightforward challenge that included a JSFuck language. Just needed to decode the text.

Used dcode.fr to decode the text and get the flag:

ZazaStore

This was an online marketplace. An interesting thing was that there was a FakeZa product which gave a fake flag, it hinted me that the real flag was RealZa product.

Code Analysis:

.
├── challenge.zip
└── src
    ├── app
    │   ├── package.json
    │   ├── package-lock.json
    │   ├── public
    │   │   ├── images
    │   │   │   ├── CartoonZa.png
    │   │   │   ├── ElectricZa.jpeg
    │   │   │   ├── FakeZa.jpeg
    │   │   │   ├── RealZa.jpeg
    │   │   │   └── ZazaIsBad.png
    │   │   └── style
    │   │       └── style.css
    │   ├── server.js
    │   └── views
    │       ├── cart.ejs
    │       ├── index.ejs
    │       ├── inventory.ejs
    │       └── login.ejs
    ├── docker-compose.yml
    └── Dockerfile

The /add-cart function didnot validate the product so i noticed the logic flaw. Firstly i tried to exploit a logic flaw in how JavaScript handles NaN (Not-a-Number) during comparisons. The prices object only contains specific keys (FakeZa, ElectricZa, etc.). The /add-cart route does not check if the product we are adding is actually a valid item in the store.

PascalCTF on the008Killer

Pascal CTF

Web Challenges

JSHit

ZazaStore