What?

As a CS college student, watching YouTube videos was part of my daily routine. This was around the time YouTube began transitioning from a simple video hosting platform to a social network. Naturally, people became skeptical about the recommendation algorithms. That’s when the basic idea formed: a YouTube feed that I could actually trust.

I also wanted to answer a specific question:

Does YouTube strategically withhold notifications for new videos from subscribed channels to prevent attention fatigue?

More broadly, I aimed to develop a solution that would not only answer this question but enhance the entire experience of discovering and consuming YouTube content.

The result was Tubee: a comprehensive YouTube content tracking platform.

Following the blue path, users subscribe to YouTube channels on Tubee just like they would on YouTube (of course, subscription import exists). The background celery worker will consolidate required channel metadatas in the background (The green path). Finally, users can then define “Actions” that execute automatically when new videos are uploaded, which are denoted by the red path. There are three types of actions:

• Add to playlist on YouTube
• Push notifications via:
  • Pushover
  • LINE Notify
• Download video to Dropbox

Actions form a generalized framework that can easily integrate with more complex use cases. You can also bind actions to tags attached to subscriptions. For example, I could create an “Add to nonfiction playlist” action tagged as “Non-fiction” and apply it to channels like Half as Interesting and 3Blue1Brown, eliminating the need for individual configuration.

If you’re familiar with IFTTT or n8n, think of this as similar automation but at scale. Most importantly, everything works through webhooks rather than polling, ensuring zero-delay triggers. Notifications often arrived as fast as (or faster than) the official YouTube mobile app.

How it all begins

It was 2017, and I was still a CS sophomore. After spending my freshman year writing “basic” CS homework and dozens of tiny one-off tools, I wanted to move on to actually “building” something—a project challenging enough to push my skills and useful enough that I’d want to use it myself.

A friend mentioned that Google Cloud was offering free compute engine credits, and GitHub Student provided additional perks like free domains and developer tools. That covered the infrastructure needs.

Off We Go

From my freshman web programming course, I had basic knowledge of HTTP concepts, HTML, CSS, JavaScript, PHP, and jQuery. I started with a simple “hello world” website and deployed it to a remote server. Since I preferred Python over PHP, I found this DigitalOcean tutorial that helped me set up the stack I wanted.

My development workflow was… unconventional:

• Edit Python source code using Transmit (an SFTP client) and Sublime Text
• Save changes, which Transmit automatically synced to the server
• SSH into the server in another terminal
• Run sudo systemctl restart apache2 to test changes
• Backup? Just zip the entire project as tuber-20180315.zip and call it a day

And Boooom! I was now a “Full-stack Python Web Application engineer”… or so I thought.

Through divide-and-conquer, I gradually worked toward my goal, albeit slowly. Here are some key milestones I achieved:

• Learning how to use git (guess why 🙃)
• Center align a <div> (by floating it)
• Understand “DevOps”, and set up Travis CI¹
• Receive YouTube notification by facilitating the PubSubHubbub protocol. ²
• Witnessing the sunrise shine on my screen
• Authenticate with YouTube Data API using OAuth 2.0 (took me like, a week?)
• Containerization with Docker and Docker compose, surprisingly not difficult

It was countless nights of trial and error, programming and debugging, and an awful lot of bad technical decisions—like changing the web server from Apache to nginx without even a clear reason.

More often than not, I found myself starting somewhere trying to achieve one thing, but ending up diving deep into something I never anticipated—for instance, reading through all ssl_ciphers available in nginx.³

Expansion

After fulfilling the initial requirements, I moved on to experimenting with other engineering aspects of software projects after reading more and more engineering blogs.

Even though I didn’t implement all of them perfectly, here are some of my key takeaways from hindsight:

• Figure out at least ~85% of the requirements first, before making architectural decisions. Changing requirements is one of the biggest risks a software project may encounter, potentially making the end product beyond repair.
• Avoiding refactoring is nearly impossible. Even predicting what might change is difficult. However, breaking down your functions and components and following SRP will make your life a lot easier.
• Documentation skills take time to develop, just like writing a good resume. Some of the best documentation I’ve read includes FastAPI, Docusaurus, and Resend.

On the other hand, there were also more technical advancements, developed from natural requirements, such as:

• Logging, and I mean “structured logging”, that allows searching and matching.
• User authentication, and learning basic security principles to protect user information.
• Staging environment, so I don’t always mess up production during deployment.

Many years later, I learned that these are all part of the Twelve-factor app methodology, and I somehow achieved many of these principles without knowing they existed ¯\_(ツ)_/¯

At this point, I felt like my hard-earned skills were well developed and practically useful for building production-grade applications. Why should I bother with theoretical CS knowledge that barely exists in the real world… right?

A case deep dive

Circling back to the existing architecture, upon startup, Tubee would loop through all subscribed channels and sign up for notifications for new videos. Since subscriptions only last for five days, I had to re-subscribe every five days. That’s where I brought in APScheduler, a crontab-like background worker module which does exactly that.

I plugged it in, made it work locally, and shipped the feature to production, crossing my fingers, only to discover a peculiar issue: The logs showed that every job I set up was running multiple times when invoked, instead of just once.

Even though this wasn’t a big issue for my use case (re-subscribing five times wouldn’t hurt), I took this as a challenge.

At first glance, I thought I must have messed something up. Maybe the logger was misconfigured? Was I logging multiple times? But wait! I had fully tested this in development, and everything went smoothly, which meant something must be wrong in production. It turns out that Gunicorn⁴, the WSGI server I was using, follows a pre-fork model. This means that even though there were barely any requests, it spawns multiple workers to handle incoming requests. APScheduler gets initialized in each worker and executes jobs multiple times.

This is where the journey became rough. I started by looking for a way to define “custom initialization” that could set up the master process with APScheduler and skip it for worker processes, but this failed. I then looked for methods that would allow workers to communicate with each other (inter-process communication) and figured out a way to initialize only one APScheduler instance among them—the notorious “leader election” problem. This never really worked.

It wasn’t until I finally gave up after (literally) months of trying that I decided I should seek help from the community for the first time. I posted this Stack Overflow question which drew little to no attention, because I was terrible at phrasing and clearly articulating my question.

But guess what—I was fortunately helped by two pivotal people. The first was Alex, the author of APScheduler, who was so kind and helpful that our discussion became almost like a one-on-one project consultancy session, answering the long-standing question that had stumped me for so long. A few days later, Miguel, author of “Flask Web Development,” also pointed me in the same direction.

It turns out that if I had grasped the basics of distributed systems, I would have immediately known that supporting modules like APScheduler should have been their own component from the start, and the nightmare I encountered wouldn’t have been an issue at all.

Lessons learned:

• Seek help early. In my experience, a problem that persists over two to three long breaks is typically a good sign that you should seek help.
• Foundational knowledge is equally important and should be treated as invisible technical debt. This is especially true if your goal is to become a true full-stack developer or engineer.

Sunset

At peak, I tracked ~250 YouTube channel and process 600+ new videos per day, but that’s the furthest it ever gets.

A few months later, as I shifted my focus towards research projects at the NLP Lab, I gradually lost time to put much effort into Tubee. Even more, I also didn’t have time to watch all the YouTube videos I was interested in at all.

Having less spare time was merely a fact that led to the end of the project. The underlying real issue, however, was that the foundation of this requirement wasn’t concrete enough. The problem statement of

Solving the algorithm bias by re-introducing the chronologically-ordered video feed

…never held up, and here’s why it failed:

• It failed to draw my attention. It may be a feature, not a bug in some sense, but this is just how it works naturally.
• It doesn’t scale. People have limited time; scrolling through all subscribed uploads makes no sense.
• It doesn’t encourage exploration. Why try new channels when you can barely finish your existing watch list?

Ultimately, it failed to solve a real-world problem for the end user (ironically, myself).

As the requirements faded away, so did the development. At the time of writing, I’m officially declaring the death of my first side project, but deep down I know it has been dead for a very long time.

Circling back to the original question:

Does YouTube strategically mute notifications, to prevent causing attention fatigue?

Well, not much evidence was found. There are cases where content creators upload videos and later take them down within a short time. People who haven’t been notified may not receive notifications, and some might have their notifications rescinded. But “deliberately” silencing notifications? Not that I could find.

Reflections

Now that it’s gone (for what it’s worth), I’d like to reflect on what I probably could (or should) have done differently:

• Share it / Collaborate: Even though I never intended to make the service public, I don’t think I ever demoed it to anyone—not my family, not my friends, not anyone.⁵ This significantly reduced my chances of receiving feedback, both technical and product-wise.
• Move faster, Break more things: I think I read this early in the project and always kept it in mind, but I felt like I never really understood or achieved this. Perhaps what really drives this is having collaborators working on the same project.
• Wear different hats: Being the sole contributor to the entire project meant I had to handle roadmapping, design, implementation, testing, and feedback for every feature. The difficult part wasn’t doing all of these, but separating myself from working on all of them at once. It wasn’t until recently that I learned I should wear different hats and act in different roles for specific periods of time.

So yep, this post is my first attempt at sharing my project and experience with the public.

Last few words

Nevertheless, I gained a few crucial traits from this experience.

It’s only been a couple of years since AI coding became the new norm, and I’ve almost forgotten what it’s like to debug without AI assistance—working through problems with Google searches, reading Stack Overflow, and most importantly, paging through documentation.

Although not as often as I used to, I still enjoy reading excellent documentation. There are wonderful tutorials out there that go way beyond just explaining how things work. They’re like reading a story that recounts the past, explains the why, and reveals how something came to be. Building knowledge and understanding around core concepts develops the ability to reason about behavior and usage, and perhaps how things will evolve. Hence: “A great engineer knows their tools.”

It’s also the mindset of boundaryless exploration that I embraced, which accumulated considerable invisible technical capital that comes in handy for new projects and even at work. I’m confident enough to predict:

Talent that can RTFM and work through Stack Overflow and GitHub issues will become the next scarce resource in the tech job market over the coming decades.

What’s amazing is that this year, PyCon US is taking place right here in Pittsburgh, the steel city where I’m currently pursuing my Master’s degree. This means I can attend the event without the hassle of airfare and hotel expenses.

So let’s get straight into my findings 🚀

🐍 Python 3.13

is coming later this year!

🔖 Type Annotation

Improving type annotation syntax has been the single most important change, a trend that has been ongoing for at least 10 years in Python. Its impact is so significant that there is even a dedicated Typing summit as well as a typing committee to address this challenge.

4 PEPs have been accepted and implemented this year. At first glance, they may seem hard to understand, but when used wisely, they will help your editors and linters better understand what you’re trying to achieve, thus giving you better auto-complete suggestions.

🔓 The Removal of GIL

GIL is one of (if not most) the critical components to prevent race conditions in Python by only allowing one thread to execute simultaneously, which is beneficial for most cases. However, for tasks that require intensive computation, which could’ve been partitioned and parallelized execution, this became a significant drawback as GIL only facilitates one core when there are a lot more just sitting around doing nothing. However, GIL has existed in Python since day one, and many core-level components also depend on it, which makes the removal process harder.

To cope with this issue, Python 3.12 introduced the sub-interpreter. This allows tasks to be divided into multiple chunks and executed in multiple sub-interpreters.

However, this is just a timely step as it does not solve the fundamental issue. What we want is the complete removal of GIL, the so-called “Free-threaded,” to unleash Python’s full potential.

Last year, a group of Meta engineers had a discussion about how to implement such a huge change, and they gained some support from the company to work on this issue at full pace.

So, a roadmap is planned. PEP 703 was drafted, and the first PR has been merged into the main branch. Python 3.13 will be the first official Python version you can execute without GIL.

However, there are constraints, like a lot. So be sure to check out this talk before you start walking on the wire.

📅 CalVer?

Hugo, the release manager of Python 3.14 and 3.15, opened the discussion during the language summit about changing Python’s versioning to CalVer.

This means if this proposal is accepted, instead of 3.14 and 3.15, we will have 3.25 and 3.26.

Python has traditionally been considered versioning with SemVer, but SemVer wasn’t even a thing when Python was created. It was a time when Python did not have stable release cycles, so versioning just sort of conforms to the idea of SemVer.

However, as Python now has a one-year release cycle, switching to CalVer can have some added benefits. If interested, check out Hugo’s talk.

🌅 New packages on the horizon

Although these packages have been around for a while, they’re once again making headlines at the conference this year.

• PyScript: As WebAssembly becomes more popular and mature, more people start using PyScript to embed Python directly into websites. For pure Python packages, they can now embed playgrounds or sandboxes into their documentation, just like most JavaScript modules.
• PyO3: Rust is gaining popularity, and so will PyO3. By creating an interface wrapper around Rust using PyO3, existing Python applications or packages can intuitively exploit Rust performance.
• DuckDB: SQLite aims to be a small, self-contained variant in place of RDBMS like MySQL and Postgres. DuckDB seeks to be the same for analytical data. Although only a little user has put them into production usage, the initial developer feedback is quite positive. They’ve also announced that they will roll out managed services lately and claim that it will be more than just another instance running on the cloud. Instead, the client will work with the cloud instance to execute some minor computation locally while leaving data-intensive queries to the cloud instance to achieve a high overall performance. That sounds interesting to me, and it may be worth paying attention to check it out in the near future.

🍭 Some other thoughts

These are some other random thoughts that I find interesting to jot them down.

🥗 The foods

As I’ve mentioned, I’ve been to PyCon DE in 2021. A common thing about both conferences is that I can hardly understand their food, even when looking at the signs. However, in terms of the flavor, oh man, that’s a whole lot different. I’m unsure who is to blame for such a tasteless lunch. It could be PSF did not put sufficient funds or effort into the catering (which is understandable, and I’m not here to judge), or maybe Americans were just so used to having these disgusting nutrition compounds, so they stopped trying anyhow.

I genuinely wish they could prove me wrong next year.

👖 Why is there no pants

Strolling around sponsored booths, I got lots of SWAGs, T-shirts, hats, and even socks. This got me thinking: Why is it that no tech company is giving out SWAG pants? Is it because programmers don’t wear pants? because they all work from home?

🌯 That’s a wrap

PyCon US will still be hosted in Pittsburgh. Although I should have graduated and moved on by then, the date is close to my graduation commencement, so I suppose it will be a grand return for two events in a go then.

See you next year!

🎀 Ackownledgement

A special thank goes to CMU’s Office of Graduate and Postdoctoral Affairs for funding my admission ticket through the Professional Engagement Funding.

Just when I’m about to hit the buying button, this lovely banner bumps into my eyes:

I honestly don’t recall seeing that before, because 51% off is a huge price gap that should have made me buy it without a doubt when I first saw it. Nevertheless, before I make my way to checkout, I thought this is a good chance to try out the VPN subscription that I’ve been paying for a while. Although switching countries is just a click away, it’s still a bit of a hassle, so after playing around with some neighboring countries, I dive deep into the code to see if there’s anything I can facilitate. First I found an API endpoint at https://ppp.dracula.workers.dev, which is an API that responds the discount based on the client’s IP address. Good enough, but can be better.

🪄 Automate

Then I suddenly realize, that the API is the single source of truth of the discount, since the merchant dealing the payment does not verify the code when the user is applying the code, and the code is just a country code suffix with the fixed string of UI, so I can just brute force the code with the ISO 3166-1 code.

Here is the results:

The results are rather interesting. If you compare the results with the List of countries by GDP (PPP) per Capita, you can see there are some mismatches:

• 🇸🇬 Singapore ranked with the 4th most purchasing power, but still has a 36% of discount
• Same goes with 🇭🇰 Hong Kong, ranked around 11th ~ 12th with a 23% of discount
• Many African has a high percentage of discount (e.g. 🇺🇬 Uganda has 69%), but some barely have any (🇱🇷 Liberia, 🇸🇴 Somalia). Although some might be due to the sanctions, that’s just my guess.

Conclusion

After some Googling, I’ve also discovered that Gumroad itself had built-in support for location deals, with some customizable options. Therefore, judging from the results, the author of Dracula UI not only grants the discount based on the purchasing power, but the disproportionate discount for some countries also shows that he is probably also granting the discount to reach more users that the theme is not yet popular in.

Nevertheless, this is a good chance and opportunity for me to dig into more about the purchasing power of different countries. Moreover, this mechanism is also a good way to bring equality to the world as an individual, and I would like to see more people doing this.

🐧 Misc

💤 Piquero

It seems quite obvious to me, this is indeed braille.

So the only thing you need to do is open up wikipedia,

lookup from the table and translate it into flag.

There are still some technique worth mentioned.

For instance, each capital letters, digits, punctuation marks have a special pre-block for indication,

and can be hard to lookup from regular table.

The solution, one way is to guess from other content, another way, for example:

if you’re trying to lookup ⠸ (dots on 4, 5, 6)

go to https://en.wikipedia.org/wiki/Braille_pattern_dots-456.

Wikipedia will list all possible decode in different language/system.

Flag：AIS3{I_feel_sleepy_Good_Night!!!}

🐥 Karuego

This is a png image given by the problem.

First thing to do is decode the compressed zip file within the image with binwalk,

binwalk -e Karuego_0d9f4a9262326e0150272debfd4418aaa600ffe4.png

and then retrieve the password of the zip file with zsteg.

$ zsteg Karuego_0d9f4a9262326e0150272debfd4418aaa600ffe4.png
[?] 1201353 bytes of extra data after image end (IEND), offset = 0x1f6d30
extradata:0         .. file: Zip archive data, at least v1.0 to extract
    00000000: 50 4b 03 04 0a 00 00 00  00 00 40 8a bd 50 00 00  |PK........@..P..|
    00000010: 00 00 00 00 00 00 00 00  00 00 06 00 1c 00 66 69  |..............fi|
    00000020: 6c 65 73 2f 55 54 09 00  03 47 d3 d0 5e ed d3 d0  |les/UT...G..^...|
    00000030: 5e 75 78 0b 00 01 04 f5  01 00 00 04 14 00 00 00  |^ux.............|
    00000040: 50 4b 03 04 14 00 09 00  08 00 6f 21 07 49 ac 2c  |PK........o!.I.,|
    00000050: 71 1f 7c b9 01 00 d6 b9  01 00 35 00 1c 00 66 69  |q.|.......5...fi|
    00000060: 6c 65 73 2f 33 61 36 36  66 61 35 38 38 37 62 63  |les/3a66fa5887bc|
    00000070: 62 37 34 30 34 33 38 66  31 66 62 34 39 66 37 38  |b740438f1fb49f78|
    00000080: 35 36 39 63 62 35 36 65  39 32 33 33 5f 68 71 2e  |569cb56e9233_hq.|
    00000090: 6a 70 67 55 54 09 00 03  71 44 a6 57 48 d3 d0 5e  |jpgUT...qD.WH..^|
    000000a0: 75 78 0b 00 01 04 f5 01  00 00 04 14 00 00 00 1d  |ux..............|
    000000b0: cd 40 aa 87 37 8a 57 93  85 a9 4c b3 cf fd 58 2d  |.@..7.W...L...X-|
    000000c0: 38 10 a2 2a dc 61 3e 8a  67 bf 4c c1 e1 cb d0 d0  |8..*.a>.g.L.....|
    000000d0: 32 65 97 d0 b5 ef f0 a5  2a 04 a6 00 af b2 63 e9  |2e......*.....c.|
    000000e0: 19 c2 6a 7b de 79 a3 a2  3f 0a b3 e8 74 67 35 ec  |..j{.y..?...tg5.|
    000000f0: 1b 8b 90 c9 76 30 ad ab  18 7a e9 9a ed f7 8e 7c  |....v0...z.....||
b1,rgb,lsb,xy       .. text: "The key is : lafire"
b1,bgr,lsb,xy       .. <wbStego size=865108, data=";M\xCD!,\xC5\xA0:\x807"..., even=false, enc="wbStego 2.x/3.x", controlbyte="\x80">
b3,r,lsb,xy         .. file: gfxboot compiled html help file
b3,bgr,msb,xy       .. file: Applesoft BASIC program data, first line number 2
b4,r,lsb,xy         .. file: PDP-11 UNIX/RT ldp
b4,g,lsb,xy         .. file: a.out VAX demand paged (first page unmapped) pure executable not stripped
b4,b,lsb,xy         .. file: Targa image data - Map 16 x 4096 x 16 +16 +4353 ""
b4,rgb,lsb,xy       .. file: Targa image data - Map (256-4112) 4096 x 65536 x 1 +4097 +257 - right ""
b4,bgr,lsb,xy       .. file: PDP-11 UNIX/RT ldp

In this case, the password is lafire,

decompress the zip file, there will be an image which contains the flag.

If you’re wondering how to find out all these, simply put, Googling.

To be more specific, Google keyword CTF Image.

Be careful of letter l and digit 1, it took me some time to distinguish those….

Flag：AIS3{Ar3_y0u_r34l1y_r34dy_t0_sumnn0n_4_D3m0n?}

🌱 Soy

QR Code fixing, nothing special.

It is, however, going to be helpful, if you have some prior knowledge to QR Code.

Take this empty QR Code as example:

Red section is for positioning, blue section is Format Info.

I fix the QR Code with QRazyBox, clicking the blue section will list all possible format.

Compare from the QR Code given, Error Correction Level: L，Mask Pattern: 0 is the only possible solution

The rest is just filling the blocks, once you have fill enough blocks, you’ll be able to decode the flag

Flag：AIS3{H0w_c4n_y0u_f1nd_me?!?!?!!}

👑 Saburo

I didn’t really get the idea of this problem at first.

The only thing I discovered is you can get a slightly higher delay in milliseconds with AIS3{ as input.

I kind of know how to acquire the flag, but doesn’t seems legit to me, so I leave the puzzle for later.

Until the second night of the contest, I found that many contestent were complaining that the results were unstable.

I then realize, brute force is probably the only solution.

So I draft a Python script to iterate all ASCII Pritable letters, and do a while true loop until the presence of }.

Something look like this:

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("60.250.197.227", 11001))
s.send(b"\n");
s.send(input(s.recv(1024).strip().decode()).encode())
print(s.recv(1024).strip().decode())

However it doesn’t work as I expected it to like it is in terminal, the delay stays low.

My second thought is to convert the script into a shell script, but I just can’t, I failed.

Out of the desperation, this is what I came up with:

If you don’t have a clue, this is called QuickMacro.

It’s basically just automatically executing a pre-record keyboard/mouse event.

I’m using Keyboard Maestro on Mac, but I believe any QuickMacro on any platform has the ability to achieve something similar.

It’ll work like this:

During this iteration, the corrrect letter is i, which is kind of hard to find the difference.

According to author, each letter tops up 5ms of noise.

So at the final stage of decoding, you have to run 10 times for each letter, calculate mean value to really find out the correct letter….

or really, just, use your

You are my Ene…. energy?

If you’re lack of imagination (like me)

just…. try it harder than.

The final letter has about 400ms of delay.

Flag：AIS3{A1r1ght_U_4r3_my_3n3nnies}

♻️ Reverse

🎹 Fallen Beat

Decompress the zip archive, fire up jar executable, you’ll soon realize this is a custom music game.

To acquire the flag, you’ll have to outbeat a full combo.

For those who really are trying:

Don’t even think about it.

First thing first, decompile jar executable.

There are dozen ways to achieve that,

my entry-level-approach will be….

online decompile, which doesn’t suck, to be honest.

The directory contains many java source code file,

global search for keyword flag,

you’ll find a method setValue within Visual/PanelEnding.java contain somthing like

if (t == mc) {
    for (int i = 0; i < cache.size(); ++i) {
        final byte[] flag = this.flag;
        final int n = i % this.flag.length;
        flag[n] ^= (byte)(Object)cache.get(i);
    }
    final String fff = new String(this.flag);
    this.text[0].setText(String.format("Flag: %s", fff));
}

You can see that flag is not stored with plain text, it’s generated by one of the class attributes flag

and xor with a cache that got pass in. Therefore, we’ll need to trace what is the cache that got passed in.

Do a second global search with SetValue, the result indicate that SetValue is only called in Control/GameControl.java.

Take some time, you realize the cache is the class attribute within class,

so searching this.cache in this file can find out that this.cache is decalared inside the constructor

// ...
final FileReader fr = new FileReader(fumenPath);
final BufferedReader br = new BufferedReader(fr);
// ...
this.cache = new ArrayList<Integer>();
// ...
while (br.ready()) {
    final String s = br.readLine();
    if (s.charAt(0) != '*') {
        // ...
        this.cache.add(a);
        // ...
    }
}

Another problem here is that fumenPath is also a parameter that got pass in during the initialze of the class instance.

So, we’ll do a thrid global search with keyword GameControl.

Luckily, GameControl is only initalized once insideControl/Frame.java.

Finally, we found out that fumenPath is songs/gekkou/hell.txt.

Repacking eveything above into Exploit.java,

and move songs/gekkou/hell.txt to the same directory, then execute the java source code, you’ll be able to retrieve the flag.

Be careful that the br object that was used to read cache, reads an additional line before reading cache

this.bpm = Integer.parseInt(br.readLine());

so you’ll add this into Expolit.java, to prevent decoding error.

Flag：AIS3{Wow_how_m4ny_h4nds_do_you_h4ve}

🙊 Crypto

🦕 Brontosaurus

It’s abvious that the final keyword KcufsJ is a reverse spelling of JsfucK

(well actually, you can findout that with Google, too)

It’s a custom JavaScript, you can found a decompiler with Google easily.

Fill in the code, which wouldn’t work, is beacuse you have to reverse it first.

Flag：AIS3{Br0n7Os4uru5_ch3at_3asi1Y}

🦖 T-Rex

The keyword of this problem is nihilist,

which defined a person that who had a philosophical view that all knowledge and values are baseless,

which in fact, does not help solving this problem, at all.

But nihilist cipher did.

If you’re wondering how do I came up with an additonal keyword, cipher, the keyword is nihilist CTF or nihilist encoding.

Nihilist cipher are composed of two components, a polybius square and a encrypted text.

You can decode the text by matching the corresponding block in the square mattrix.

There are a lot of online tools, but I don’t find any being helpful,

so I made my own version with Python, take a look at T-Rex.py if you’re interested.

Flag：

AIS3{TYR4NN0S4URU5_R3X_GIV3_Y0U_SOMETHING_RANDOM_5TD6XQIVN3H7EUF8ODET4T3H907HUC69L6LTSH4KN3EURN49BIOUY6HBFCVJRZP0O83FWM0Z59IISJ5A2VFQG1QJ0LECYLA0A1UYIHTIIT1IWH0JX4T3ZJ1KSBRM9GED63CJVBQHQORVEJZELUJW5UG78B9PP1SIRM1IF500H52USDPIVRK7VGZULBO3RRE1OLNGNALX}

🌐 Web

🦈 Shark

First look at the main page

Source code doesn’t reveal anything interesting, try clicking the link

The hint says that the flag is not located on the server that we’re visiting, but a server located in the same local network.

By obeserving the URL, you can assume that the path parameter can be used to view some file on the server.

I managed to know that unix system tends to store local network informations in /proc/net/fib_trie.

Therefore, our first attempt:

https://shark.ais3.org/?path=/proc/net/fib_trie

The access is forbidden, try somethign else:

https://shark.ais3.org/?path=index.php

Well, that worked.

You can see that the php source code blocks any access that make use of absolute path and any relative path starts with ...

This is where php:// came in.

php:// is a pseudo protocal, which is used to proces data stream

For instance, the exmaple given in php documentation:

readfile("php://filter/resource=http://www.example.com");

loads the content of http://www.example.com.

So we changed the original URL from

https://shark.ais3.org/?path=/proc/net/fib_trie

into

https://shark.ais3.org/?path=php://filter/resource=/proc/net/fib_trie

TA-DA!!!

All we need to do now is to analyze the content.

There are many tutorial on Google,

but an obvious way is by guessing that

0.0.0.0 is for unicast,

127.0.0.0 is for something realted to localhost.

The only possible answer are those begin with 172.

Combine with the hint given previously,

try this

https://shark.ais3.org/?path=php://filter/resource=http://172.22.0.1/flag

doesn’t work.

Try again

https://shark.ais3.org/?path=php://filter/resource=http://172.22.0.2/flag

BINGO🎉

Flag：AIS3{5h4rk5_d0n'7_5w1m_b4ckw4rd5}

🐘 Elephant

Let’s see the landing page

not a clue, try a random name

from the keyword token, I assume, the previosu page is login interface,

output the flag according to the name given.

Normally, there will be a cookie after login, let’s see.

PHP cookies are normally base64 encoded, decode them first.

O:4:"User":2:{s:4:"name";s:4:"Tomy";s:11:"?User?token";s:32:"8bd5e99e146d0af7cc75e8f2bcc9693e";}

Next, according to a hint from this cheatsheet: w181496 / Web-CTF-Cheatsheet,

and the knowledge of any PHP string == boolean true.

By modifying the cookie into

O:4:"User":2:{s:4:"name";s:4:"Tomy";s:11:"?User?token";b:1;}

then base64 encode, fill back into the browser.

Flag：AIS3{0nly_3l3ph4n75_5h0uld_0wn_1v0ry}