# 2️⃣ Download the image and extract the token from EXIF curl -s "$BASE$thumb" -o thumb.jpg token=$(exiftool -UserComment thumb.jpg | awk -F': ' 'print $2') echo "[+] Token extracted: $token"
# 1️⃣ Grab a random thumbnail to extract the token thumb=$(curl -s "$BASE/" | grep -oP '(?<=src=")/static/img/[^"]+\.jpg' | head -n1) booru.allthefallen.more
UserComment : flagb0oru_4ll_th3_f4ll3n_m0r3 That was the flag! For completeness, I also tried a classic LSB steganography check on the image using zsteg : # 2️⃣ Download the image and extract the
# 3️⃣ Use the token to access the hidden page curl -s "$BASE/more?token=$token" > more.html booru.allthefallen.more
UserComment : token=Ym9ydV9ibG9ja19zdXJ2aXZl The value is Base64‑encoded. Decoding it gives: