# 1️⃣ Grab a random thumbnail to extract the token thumb=$(curl -s "$BASE/" | grep -oP '(?<=src=")/static/img/[^"]+\.jpg' | head -n1)
# 2️⃣ Download the image and extract the token from EXIF curl -s "$BASE$thumb" -o thumb.jpg token=$(exiftool -UserComment thumb.jpg | awk -F': ' 'print $2') echo "[+] Token extracted: $token" booru.allthefallen.more
<!-- token is stored in the image EXIF --> All thumbnails were JPEG files served from /static/img/<hash>.jpg . Downloading a few of them with wget and inspecting the EXIF data ( exiftool ) revealed a custom tag: # 1️⃣ Grab a random thumbnail to extract
curl -s -o hidden_flag.jpg "https://booru.allthefallen.more/static/img/hidden_flag.jpg" At first glance it was a plain JPEG with a resolution of 1×1 pixel – just a black dot. Running exiftool again gave: For completeness, I also tried a classic LSB
UserComment : flagb0oru_4ll_th3_f4ll3n_m0r3 That was the flag! For completeness, I also tried a classic LSB steganography check on the image using zsteg :
