Source Sleuth

The rendered page is only one interpretation of the response your browser received. Inspect the original document and determine what the interface chose not to display.

Objective

Distinguish rendered content from the original HTML response.
Explain why comments cannot protect information sent to a client.

Before you begin

Open /challenge/source. Review browser basics if you have not used View Page Source before.

Concepts

Browsers receive markup before constructing a visible page. Comments, hidden elements, scripts, and attributes remain available to anyone who receives that markup, even when they are not rendered as text.

Browser-controlled pages, cookies, and request fields cross a server trust boundary. The server validates input and applies its own authentication and authorization policy.

The browser can change local markup, storage, cookies, and request fields. Hiding a control or trusting a client-supplied role does not enforce permission. The server validates input, establishes identity, checks authorization, and limits writable fields before changing trusted state. A signed client value still needs correct verification, scope, and freshness checks.

Suggested tools

Page-source viewer: Shows the original response; a saved HTML file and text editor are an accessible alternative.

Tool practice

Rehearse the worked tool exercise before using challenge data.

Practice locating the comment in the local HTML example. On the game page, open source and use Find to locate a comment; copy its surrounding line into your evidence notes. Editing the inspector is unnecessary for reading source.

Investigation

Observe

Compare the visible page with its original HTML source. Search for comments and the usual Pocket CTF completion-token prefix.

Form a hypothesis

What information did the server send even though the layout did not display it?

Test carefully

Read the response only. Do not confuse the live Elements tree, which a browser may modify, with the original page source.

Progressive hints

Hint 1

Use View Page Source, not only the Elements panel.

Hint 2

Search the HTML for a comment near the end of the response.

Hint 3

Search for the completion-token prefix and copy the complete value.

Troubleshooting and reset

If your browser replaces the current page when viewing source, open source in a new tab. Reloading does not change this module or its flag.