Overview
We must classify 30 dynamically-generated images as Genuine (Real) or Anomalies (Fake). Perceptual hashing helps track images that undergo minor binary changes between sessions.
Reconnaissance
HTML comments hint that the set of images is fixed (15 real, 15 fake).
The API endpoints are:
POST /api/timeline/startPOST /api/timeline/verify(returns correct guess counts)
Exploitation Strategy
We query a session and compute the perceptual hash (phash) of the images using Python's imagehash library.
We use the verification endpoint as an Oracle: sending a timeline payload of all 0s with a single 1 at the target index will increase or decrease the score, revealing the correct value (1 for Real, 0 for Fake).
We map the 30 hashes in our database, start a final session, map the new dynamic images to the hashes, and submit the correct array.
Solution Code
# Script computes imagehash.phash of downloaded files,
# uses verification oracle to construct mapping database: hash -> verdict,
# submits complete sequence to retrieve flag.
# Flag: CrackOn{phash_timeline_verification_unlocked}Flag
CrackOn{phash_timeline_verification_unlocked}