ApoorvCTF 2026 - Sanity Check - Miscellaneous Writeup

Category: Miscellaneous Flag: apoorvctf{d0n7_w0rry_y0u_4r3_s4n3}

Challenge Description#

Hallo, Wave 2 has been released , Happy pwning

Analysis#

At first this one felt like a troll because the obvious Discord flag everyone sees is the welcome free-points one, and that was wrong for this challenge.

tableflip

So I stopped overthinking and did the basic thing manually: looked at the suspicious announcement that matched the exact challenge text vibe (the Wave 2 post), copied that message content, and inspected it as escaped Unicode. The escaped output immediately showed tons of invisible characters (\u200c, \u200d, \u202a, \u202c, \ufeff) injected all over the text, which is a classic hidden-payload signal.

1
TOKEN="<discord_token>"
2
CID="1089453266208829520"
3
MID="1479871689105084446"
4
curl -s -H "Authorization: $TOKEN" "https://discord.com/api/v9/channels/$CID/messages?around=$MID&limit=100" \
5
| jq -r '.[] | select(.id=="1479871689105084446") | .content'

1
‌‌‌‌‬‪Hallo @everyone ‌‌‌‌‪‪!
2

3
Wave ‌‌‌‌‪‍‌‌‌‌‪‍2‌‌‌‌‪ is ‌‌‌‌‬‬‌‌‌‌‬now released! 🌊 ‌‌‌‌‬‍ ‌‌‌‌‌‪We hope ...

1
python - <<'PY'
2
import os
3
import requests
4

5
token = "<discord_token>"
6
cid = "1089453266208829520"
7
mid = "1479871689105084446"
8
api = "https://discord.com/api/v9"
9

10
r = requests.get(
11
    f"{api}/channels/{cid}/messages",
12
    headers={"Authorization": token},
13
    params={"around": mid, "limit": 100},
14
    timeout=30,
15
)
16
msg = [m for m in r.json() if m["id"] == mid][0]["content"]
17
print(msg.encode("unicode_escape").decode())
18
PY

1
\u200c\u200c\u200c\u200c\u202c\ufeff\u202aHallo @everyone \u200c\u200c\u200c\u200c\ufeff\u202a\u202a!
2
\n\nWave \u200c\u200c\u200c\u200c\ufeff\u202a\u200d\u200c\u200c\u200c\u200c\ufeff\u202a\u200d2...

From there the decode path was straightforward: split invisible runs into fixed 7-symbol chunks and treat each symbol as a base-5 digit. The mapping that produced readable text was \u200c=0, \u200d=1, \u202a=2, \u202c=3, \ufeff=4. Decoding those base-5 chunks gave the flag text directly.

1
python - <<'PY'
2
import re
3
import requests
4

5
token = "<discord_token>"
6
cid = "1089453266208829520"
7
mid = "1479871689105084446"
8
api = "https://discord.com/api/v9"
9

10
r = requests.get(
11
    f"{api}/channels/{cid}/messages",
12
    headers={"Authorization": token},
13
    params={"around": mid, "limit": 100},
14
    timeout=30,
15
)
16
msg = [m for m in r.json() if m["id"] == mid][0]["content"]
17

18
runs = []
19
cur = ""
20
for ch in msg:
21
    cp = ord(ch)
22
    if (0x200B <= cp <= 0x200F) or (0x202A <= cp <= 0x202E) or (0x2060 <= cp <= 0x206F) or cp == 0xFEFF:
23
        cur += ch
24
    else:
25
        if cur:
26
            runs.append(cur)
27
            cur = ""
28
if cur:
29
    runs.append(cur)
30

31
mp = {"\u200c": 0, "\u200d": 1, "\u202a": 2, "\u202c": 3, "\ufeff": 4}
32

33
out = []
34
for r in runs:
35
    for i in range(0, len(r), 7):
36
        blk = r[i:i+7]
37
        if len(blk) < 7:
38
            continue
39
        v = 0
40
        for ch in blk:
41
            v = v * 5 + mp[ch]
42
        out.append(chr(v))
43

44
decoded = "".join(out)
45
print(decoded)
46
print(re.findall(r"apoorvctf\{[^}]+\}", decoded, re.I))
47
PY

1
apoorvctf{d0n7_w0rry_y0u_4r3_s4n3}
2
['apoorvctf{d0n7_w0rry_y0u_4r3_s4n3}']

Solution#

1
import re
2
import requests
3

4
TOKEN = "<discord_token>"
5
CHANNEL_ID = "1089453266208829520"
6
MESSAGE_ID = "1479871689105084446"
7
API = "https://discord.com/api/v9"
8

9
r = requests.get(
10
    f"{API}/channels/{CHANNEL_ID}/messages",
11
    headers={"Authorization": TOKEN},
12
    params={"around": MESSAGE_ID, "limit": 100},
13
    timeout=30,
14
)
15
msg = [m for m in r.json() if m["id"] == MESSAGE_ID][0]["content"]
16

17
runs = []
18
cur = ""
19
for ch in msg:
20
    cp = ord(ch)
21
    if (0x200B <= cp <= 0x200F) or (0x202A <= cp <= 0x202E) or (0x2060 <= cp <= 0x206F) or cp == 0xFEFF:
22
        cur += ch
23
    else:
24
        if cur:
25
            runs.append(cur)
26
            cur = ""
27
if cur:
28
    runs.append(cur)
29

30
mapping = {"\u200c": 0, "\u200d": 1, "\u202a": 2, "\u202c": 3, "\ufeff": 4}
31

32
decoded = []
33
for r in runs:
34
    for i in range(0, len(r), 7):
35
        blk = r[i:i+7]
36
        if len(blk) < 7:
37
            continue
38
        value = 0
39
        for ch in blk:
40
            value = value * 5 + mapping[ch]
41
        decoded.append(chr(value))
42

43
decoded_text = "".join(decoded)
44
print(decoded_text)
45
print(re.findall(r"apoorvctf\{[^}]+\}", decoded_text, re.I))

1
python solve.py

1
apoorvctf{d0n7_w0rry_y0u_4r3_s4n3}
2
['apoorvctf{d0n7_w0rry_y0u_4r3_s4n3}']