$ cat mission.txt — 10 flags, 1375 points, zero backends.
Every flag looks like gods{...} and is hidden somewhere on this
site — in the source, in a file, in a token, in the spaces between letters. Solve them
entirely client-side, then submit in the terminal:
flag submit gods{...}. Progress is tracked locally — run
ctf in the terminal for the live scoreboard and hints.
The /ctf shrine renders spotless to mortal eyes — but the ancients always carved an inscription into the rafters where no one thinks to look. The build gods left their mark when they deployed that page from Olympus. Find the inscription and read it the way a god would: not as it is shown, but as it is written.
↳ start: view-source of the /ctf page — read the <head>
A courier from Olympus dropped a sealed scroll in ~/.ctf/scroll_of_hermes. Hermes never sends prophecy in the clear — he seals it twice before it crosses the wire. Read the scroll, note HOW he seals it, and unwrap the layers in the right order.
↳ start: cat ~/.ctf/scroll_of_hermes
An old god left a prophecy behind in ~/.secrets. It does not want to be read — it wants to be earned. The browser console has a hint for those who open it. Decode the prophecy and speak the truth back.
↳ start: the console banner points the way; then cat ~/.secrets/prophecy.txt
Deep in /opt/olympus lies a dead daemon: forge.js. Once it stamped out keys for every god on the mountain; now the fire is out and the smith answers no one. The code still remembers how to forge one last key — but only if the right offering is spoken. Read the ruin, wake the smith, and take what he makes.
↳ start: cat /opt/olympus/forge.js
An old verse rests in ~/scriptures/unseen.txt. Forty-one characters of scripture — or so your eyes report. The oracle swears the scroll weighs far more than that. Faith, after all, is the evidence of things not seen.
↳ start: cat ~/scriptures/unseen.txt
At 03:08 UTC someone hammered the gates of Olympus until they gave. The intruder did not leave empty-handed — the ferryman carried the stolen relic across the Styx one coin at a time, and coins do not board in order. The web server saw everything and wrote it down before the thief could burn the ledger. Find the intruder, follow the ferry, reassemble what was taken.
↳ start: cat /var/log/olympus/access.log
The gate signs every request to Olympus with an X-Bogus header — no secret key, just an algorithm nobody was meant to read. signer.js in /opt/olympus still carries it, and a vault it sealed under the signature of one canonical request. You need to guess nothing: sign the request the way the code does, then let the keystream fall away.
↳ start: cat /opt/olympus/signer.js
The ASR tap in ~/.ctf/whisper.samples caught a stream the transcript came back empty on. The words are not in the audio — they are under it. Every sample carries one stolen bit in the place no one listens: the noise floor.
↳ start: cat ~/.ctf/whisper.samples
gate.olympus issued you a session token — three dot-separated base64url segments, a JWT. You are role:guest. The payload carries a sealed "vault", but the gate never checks its own signature. Decode all three segments, read what the gate confesses about how it unseals, escalate, and the vault opens.
↳ start: the token is printed by `ctf alg-none-ascension` (below)
A cracked APK sits in /opt/olympus: checklicense.js, lifted straight out of com.olympus.gate. It phones no server — the whole license check runs on the device, which was its first mistake. The key that makes checkLicense() return true is the flag. Write the keygen the vendor was afraid you would.
↳ start: cat /opt/olympus/checklicense.js
New here? Open the terminal, type ctf, and
pick a target. The easy ones only need view-source and a base64 decoder.