# CyberChef - Hoperation Save McSkidy (TryHackMe) 🎉🧑‍🎄 Security controls are only as strong as the logic behind them. Many systems rely on encoding, hashing, and simple transformations to protect sensitive information, assuming that obscurity alone is enough to keep attackers out. However, when these mechanisms are misunderstood or poorly implemented, they can often be reversed, chained, or abused to bypass authentication entirely. In this challenge, defenders step into an investigative role where success depends on understanding how data is transformed rather than simply protected. By examining web application behaviour, HTTP headers, client-side logic, and encoded communications, we learn how seemingly harmless information can be leveraged to unlock protected systems. Tools like CyberChef become essential for decoding, chaining operations, and reversing transformations that guards and applications rely on for security. Through progressively complex locks, this investigation reinforces a core lesson in web security: encoding is not encryption, and relying on reversible logic for protection introduces serious risk. Each step mirrors real-world scenarios where attackers extract clues from applications and use them to defeat access controls. ## Introduction **The Story** ![Task banner for day 17](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763533892160.png align="left") *McSkidy is imprisoned in King Malhare's Quantum Warren. Sir BreachBlocker III was put in charge of securing the fortress and implemented several access controls to prevent any escape. His defenses are worthy of his name.* *However, McSkidy managed to send vital clues to his team using harmless bunny pictures. One message revealed that five locks needed to be disabled to secure an escape route. The locks can be broken by examining their logic and leveraging the system's built-in chat for the guards. They can be eluded in revealing vital details or even passwords. However, you will need to speak their language.* ## **Learning Objectives** * Introduction to encoding/decoding * Learn how to use CyberChef * Identify useful information in web applications through HTTP headers ## Important Concepts ## **Encoding and Decoding** Encoding is a method to transform data to ensure compatibility between different systems. It differs from encryption in purpose and process. | | **Encoding** | **Encryption** | | --- | --- | --- | | **Purpose** | Compatibility Usability | Security Confidentiality | | **Process** | Standardized | Algorithm + Key | | **Security** | No | Yes | | **Speed** | Fast | Slow | | **Examples** | Base64 | TLS | Decoding is the process of converting encoded data back to its original, readable, and usable form. ## **CyberChef Overview** [CyberChef](https://cyberchef.io/) is also known as the Cyber Swiss Army Knife. Ready to cook some recipes? | **Area** | **Description** | | --- | --- | | Operations | Repository of diverse CyberChef capabilities | | Recipe | Fine-tune and chain the operations area | | Input | Here you provide the input for your recipe | | Output | Here is the output of your recipe | ## **Simple Example** Try your first recipe: * Open either the online [CyberChef](https://cyberchef.io/) version in your regular browser, or use the offline CyberChef version available in the bookmarks section of the AttackBox. Drag and drop the `To Base64` operation from the **Operations** area on the left side to the **Recipe** area in the center, and add `IamRoot` into the **Input** area. * Add another operation, `From Base64`, to show the initial input again, showcasing chain operations. **Note:** You can enable/disable an operation in the recipe by toggling the middle button on the right of the operation. ![Cyberchef simple example of how to encode an input in Base64.](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1762941123967.png align="left") Congratulations! You took the first steps to become a master Chef. ## **Inspecting Web Pages** Besides the rendered content of a web page, your browser usually receives and can show additional information. For this challenge, you will get the chance to have a deeper look at that information and put it to good use. To do this, depending on your browser, you can access the functionality as shown below: | **Browser** | **Menu path** | | --- | --- | | Chrome | `More tools` > `Developer tools` | | Firefox | `Menu` (☰) > `More tools` > `Web Developer Tools` | | Microsoft Edge | `Settings and more (...)` > `More tools` > `Developer tools` | | Opera | `Developer` > `Developer tools` | | Safari | `Develop` > `Show Web Inspector` (Requires enabling the "Develop" menu in `Preferences` > `Advanced`) | ## First Lock - Outer Gate ## **Key Information** If not already, start the target machine, give it a few minutes to boot up, and then, from the AttackBox, you can access the web app at [`http://MACHINE_IP:8080`](http://MACHINE_IP:8080). McSkidy revealed some vital clues in his message. You will have to leverage any useful piece of information in order to break the locks. Below are key points to look out for: * **Chat is Base64 encoded**. Try decoding this in CyberChef. This will be leveraged to extract useful information from the guards. Be aware that from Lock 3 onwards, the guards will take a longer time to respond. ![Example of encoded Bunnygram chat](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1761561410887.png align="left") * **Guard name**. This logic will persist throughout the levels. Make sure to note down the guard’s name for each level. ![Example of hint in the login form](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1761136162115.png align="left") * **Headers**. Again, inspecting the page but switching to the ‘*Network*’ tab this time. Make sure to refresh the page once after switching to this tab and select the first response. ![Example of finding header information](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1764069898747.png align="left") * **Login Logic**. You will inspect the page and switch to the ‘*Debugger*’ tab. Match the lock with the respective logic. You can also find helpful comments that explain what you need to cook in CyberChef. ![Example of finding login logic](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1761136162547.png align="left") ## **First Lock - Outer Gate** Ok, it’s time to siege the fortress. Ready?      1. First, identify the guard name and encode it to Base64. You will use this as the username input.      2. Next, using the information from the page headers, identify the magic question and encode it in Base64 as well. ![Shows first lock magic question: "What is the password for this level?"](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763622327932.png align="left")      3. Use the encode magic question in the chat. The guard will answer with the encoded level password.      4. Now, switch to the ‘*Debugger*’ tab and identify the login logic. In this case, the password is encoded to Base 64. ![Shows first lock login logic: simple Base64 encoding](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763622523221.png align="left")      5. By decoding the answer from the guard, you will have the plaintext password.      6. Use the encoded username and plaintext password to log in. Excellent work! One lock is down, and only four remain to be broken. ### Answer the questions below 1. What is the password for the first lock? ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766363889249/3a5e3dc7-a42c-443e-8985-cece4d0b961b.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766363610097/f35f7fb4-f914-4948-82e3-f75585f2a933.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766363654427/0a857583-5b88-4630-be50-45d9f162ea0a.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766363687172/a913da02-d779-4bfe-80e8-2f68a52c5987.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766363710042/1f27869e-72f2-405a-9df1-d96d499ed000.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766363739019/ea0b049a-dad0-49e9-85cd-5cb8dad395c8.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766363812933/70097c77-3c1b-43ce-836f-26a2703168d8.jpeg align="center") ## **Second Lock - Outer Wall** Excellent job breaking that first level. This level nudges the difficulty up a little bit, but don’t worry, you will figure it out. Let’s go!      1. Again, identify the guard's name and save the encoded output for later.      2. Then, extract and encode the magic question and retrieve the encoded password from the guard. ![Shows the second lock magic question: "Did you change the password?"](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763623056230.png align="left")      3. Looking again at the login logic, you see that the encoding is applied twice this time. That means you have to decode from Base64 twice.      4. Go ahead and log in with the newfound password and the saved username. ![Shows the second lock login logic: double Base64 encoding](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763623056841.png align="left") You are getting closer to securing an escape route; only three locks remain. Keep up the good work. ### Answer the questions below 1. What is the password for the second lock? ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766363959241/1ac74297-db28-46e8-aa91-5b706c36fa9e.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364017271/e243ea62-e7c3-40cc-9bba-d403311e9790.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766363991620/da8cee6d-ddd7-46a5-97f9-16d79ca9aa95.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364107653/8154374b-8a85-478b-99da-aa546e1d7073.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364120411/4066e12f-e327-42c5-9c6e-7572c3c8d278.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364179254/156773af-2c50-4f21-9c87-2b600de652d7.jpeg align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364203686/051fc753-d186-4341-a850-06748128ee2e.png align="center") ## Third Lock - Guard House So far, so good. As you saw in the previous level, the login logic begins to use chained operations. This will be the trend for this and the following levels. 1. As always, collect all the needed information (encoded username, encoded password from the guard, XOR key). ![Shows the third lock XOR key: "cyberchef"](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763623688692.png align="left") **Note:** From this lock onwards, there is no magic question, but sometimes you can ask the guard nicely to give you the password. It will still need to be decoded as per the login logic. Be aware that the guard may sometimes fall asleep or take a long time to respond (~2-3 minutes) so keeping the message short will help get the answer. Even a simple 'Password please.' will go a long way.      2. If you look at the login logic, there is a slight twist. The password is first XOR’ed with a key and then encoded to Base64. ## **Theory Time** > XOR is a popular operation that, besides the input data, also uses a key. The process involves a bitwise exclusive OR between the data and key. > > ![Shows the XOR logic diagram](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763638274313.png align="left") > > You might ask, “*Ok, but how do I reverse this?*”. Well, skipping the long math explanation, XOR has a magic property: when you XOR the result with the key again, the new result will be the initial data. Go ahead, try this in CyberChef. Put two XOR operations one after another, use the same key for both, and the output should be identical. ![Shows that double XOR-ing an input with the same key provides the same output.](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763536921553.png align="left")      3. With this newfound knowledge, build the needed recipe to find the plaintext password. ![Shows the third lock login logic: XOR with key and then encode Base64](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763625972684.png align="left") ![Shows the recipe for reversing the encoding: From64 and XOR with key](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1764064441038.png align="left")     4. Use the credentials and unlock the next level. ### Answer the questions below 1. What is the password for the third lock? ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364332815/16dfa0ce-64c4-4823-b66f-8e391827866c.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364362348/66eca27d-4e5e-447d-b6d8-5b28181597e1.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364428909/c4d3eefc-eb62-4c7a-aab1-94004e87d413.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364482345/34959ae3-8ce3-4323-8078-353979c7885d.jpeg align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364501099/f6b1ef0d-9a4f-48ac-b6fd-084fae19f88f.png align="center") ## Fourth Lock - Inner Castle We are almost there. In this level, Sir BreachBlocker III throws you a curveball. Let’s see how to tackle this.      1. But first, go ahead and look at the login logic as before. We will not be needing header information for this one. ![Shows the fourth lock login logic: MD5 hash](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763626852157.png align="left")      2. After asking the guard for the password and looking at it's reply, it seems a bit odd. At the same time, the login logic shows the use of a MD5 hash. ![Shows that the decoded guard answer reveals a hash string](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763626851107.png align="left") ## **Theory Time** > MD5, or Message-Digest Algorithm 5, is a cryptographic algorithm that produces a fixed-size hash value. While this is supposed to be a one-way function, meaning you cannot reverse it, precomputed hashes can be leveraged to identify the input.      3. Putting the two together, the plaintext password is passed through MD5, and you have the hash. This looks like a job for [CrackStation](https://crackstation.net/).      4. Go ahead and open the site and paste the hash to retrieve the password. ![Shows Crackstation with the hash input and decoded password](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763626852611.png align="left")      5. Use the credentials and advance to the final level. Fantastic. One more lock and you will ensure McSkidy has safe passage and escapes. ### Answer the questions below 1. What is the password for the fourth lock? ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364552296/60b6388b-0b56-466d-878c-319fbba2b514.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364589725/9d095b9c-bc19-4f43-bd88-f53a322c4014.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364617877/261c55be-bd5b-429b-9a0e-f358a46fca5d.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364675724/6aceaf67-f7fd-426a-a0c2-bd6c6a4a39f3.jpeg align="center") ## Fifth Lock - Prison Tower **Fifth Lock - Prison Tower** Ready for the final hurdle? As the defenses weaken, you receive another hidden message from McSkidy: *“I can see you are ready to break the last lock. Be aware that Sir BreachBlocker III implemented different mechanisms for the last lock, which change occasionally. Make sure you match the correct approach when decoding the password.”* That sounds tricky, but do not despair. You will find a way.      1. Let’s start. Extract the information as before, noting down the encoded guard name. ![Shows the fifth lock login logic hint: to look at the recipe number](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763627625991.png align="left")      2. Additionally, note the recipe ID from the header and match the corresponding login logic. Below is a quick cheat sheet for decoding each recipe. | **Recipe ID** | **Reverse Logic** | | --- | --- | | 1 | From Base64 ⇒ Reverse ⇒ ROT13 | | 2 | From Base64 ⇒ From Hex ⇒ Reverse | | 3 | ROT13 ⇒ From Base64 ⇒ XOR(extracted key) | | 4 | ROT13 ⇒ From Base64 ⇒ ROT47 |      3. Build the reverse recipe with CyberChef and extract the final password. Finally, the last lock has been breached, and you provided a safe path for McSkidy to escape. ### Answer the questions below 1. What is the password for the fifth lock? ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364755468/599d281e-ada6-4ef7-b58c-4b6d7efc37a0.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364773851/bb0069eb-ab0e-46d4-a6df-65195e4161d4.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364832414/218f77e7-c80d-4037-bb5e-84f2805c72d9.jpeg align="center") 2. What is the retrieved flag? ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766364895607/9f875020-36cb-416a-b26f-695095db313b.jpeg align="center") ## Epilogue ![Shows McSkidy escaping from the castle cased by bunny guards](https://tryhackme-images.s3.amazonaws.com/user-uploads/68baea2454c82afe90fd7020/room-content/68baea2454c82afe90fd7020-1763536556206.png align="left") *As McSkidy passed by the Inner Castle, she heard a thunderous voice: “Why should Christmas have all the fun?”* *McSkidy managed to get back to Wareville just in time as TBFC was about to be hit by another disaster.* ### Answer the questions below 1. If you found decoding secrets interesting, you can also check out the [Introduction to Cryptography](https://tryhackme.com/room/cryptographyintro), which dives into the world of cryptography. 2. Looking for the key to **Side Quest 3**? Hopper has left us this [cyberchef link](https://gchq.github.io/CyberChef/#recipe=To_Base64\('A-Za-z0-9%2B/%3D'\)Label\('encoder1'\)ROT13\(true,true,false,7\)Split\('H0','H0%5C%5Cn'\)Jump\('encoder1',8\)Fork\('%5C%5Cn','%5C%5Cn',false\)Zlib_Deflate\('Dynamic%20Huffman%20Coding'\)XOR\(%7B'option':'UTF8','string':'h0pp3r'%7D,'Standard',false\)To_Base32\('A-Z2-7%3D'\)Merge\(true\)Generate_Image\('Greyscale',1,512\)&input=SG9wcGVyIG1hbmFnZWQgdG8gdXNlIEN5YmVyQ2hlZiB0byBzY3JhbWJsZSB0aGUgZWFzdGVyIGVnZyBrZXkgaW1hZ2UuIEhlIHVzZWQgdGhpcyB2ZXJ5IHJlY2lwZSB0byBkbyBpdC4gVGhlIHNjcmFtYmxlZCB2ZXJzaW9uIG9mIHRoZSBlZ2cgY2FuIGJlIGRvd25sb2FkZWQgZnJvbTogCgpodHRwczovL3RyeWhhY2ttZS1pbWFnZXMuczMuYW1hem9uYXdzLmNvbS91c2VyLXVwbG9hZHMvNWVkNTk2MWM2Mjc2ZGY1Njg4OTFjM2VhL3Jvb20tY29udGVudC81ZWQ1OTYxYzYyNzZkZjU2ODg5MWMzZWEtMTc2NTk1NTA3NTkyMC5wbmcKClJldmVyc2UgdGhlIGFsZ29yaXRobSB0byBnZXQgaXQgYmFjayE) as a lead. See if you can recover the key and access the corresponding challenge in our [Side Quest Hub](https://tryhackme.com/adventofcyber25/sidequest)! By breaking all five locks, this challenge demonstrates how layered but weak security mechanisms can be systematically dismantled through careful observation and logical analysis. Each level builds on the previous one, moving from simple Base64 decoding to chained transformations involving XOR, hashing, and multiple encoding formats. This progression reflects how attackers adapt as defenses become more complex. CyberChef proves to be a powerful ally throughout the investigation, enabling rapid experimentation with encoding and decoding recipes while reinforcing a deeper understanding of how data transformations work. Inspecting HTTP headers, client-side scripts, and application logic highlights how much sensitive information can be exposed unintentionally through web applications. Ultimately, this exercise underscores an important defensive takeaway: encoding and hashing alone do not provide meaningful security when attackers can observe and replicate the logic. Strong security design must assume that application behaviour is visible and focus instead on proper authentication, authorization, and cryptographic practices. By mastering these concepts, defenders are better equipped to identify weaknesses before they can be exploited — and ensure that no fortress falls to logic alone.