RootTheBox
RootTheBox copied to clipboard
Enhancement: Protected flags
Although common sense dictates that flags should be processed with a one-way function, similarly to how passwords are usually stored, RTB does not support this feature.
Protected flags work like in the real world - where normally things (e.g. the flags) are protected.
Some other platforms check whether flags are correct by calling a script specific to each challenge. The script could be configured to check against a protected flag....
I expect this would prevent the ability of the admin to edit the token or to see what the actual answer is, right? Couldn't the admin do this themselves by making their token a hash? Not sure I understand the request.