Draftpad

Target

https://isfcrpesu-draftpad.chals.io/

Discovery

The application loads its document data from:

GET /api/document

The page also displays the published output from:

GET /api/export/public

The document uses pinned positions for the private range. The document API showed the private start and end pins, but the private block between them was not correctly protected. In particular, inserted blocks had shifted the document's linearized indexes while the pins retained their original positions.

Requesting the public export exposed the confidential content directly:

GET /api/export/public

The response contained:

release flag: isfcr{merge_shifts_the_wall_not_the_window}

Flag

isfcr{merge_shifts_the_wall_not_the_window}