Welcome to my series of writeups for n00bzunit3d 2024 capture-the-flag competition. In this post, we look at the misc/Agree challenge. This one is relatively simple. It just asks us to agree to the terms of service and privacy policy. The catch? There’s no way to find them on the website. We looked through all the links on the webpage and we could not find one that takes us to either of them.

Time to start guessing the URL. After some trial and error, we found that https://ctf.n00bzunit3d.xyz/tos was the page for the terms of service. This gives us the first half of the flag. The link for the privacy policy is https://ctf.n00bzunit3d.xyz/privacy getting us our second half of the flag.