---
title: picoCTF 2019 - [Forensic] WhitePages (250 points)
author: Maltemo
tags: CTF, picoCTF, Forensic, Binary, Whitespace
---
picoCTF 2019 - [Forensic] WhitePages (250 points)
===
Written by [Maltemo](https://twitter.com/Maltemo), member of team [SinHack](https://sinhack.blog/) in collaboration with [SaladeTomateOnion](https://twitter.com/saladtomat0nion) team.

[TOC]
___

## Statement of the challenge

### Description

I stopped using YellowPages and moved onto WhitePages... but the page they gave me is all blank!

### File

whitepages.txt

## Analyzing the file

The file is a text file, with only one line of spaces and tabulations.

After searching in the direction of the tool called [snow](https://sbmlabs.com/notes/snow_whitespace_steganography_tool/), I found that it was a dead-end.

Next step was to check if the data contained in the file wasn't just binary.

:::info
**Fun fact** : [0p62No2]() sent me a link to the [WhiteSpace language](https://en.wikipedia.org/wiki/Whitespace_%28programming_language%29), which led me to think about spaces and tabs to store binary data.
:::

## Python Algorithm to extract the data

tab_ascii_chars = []
final_binary = ""

#Reading the file
with open('whitepages.txt','r') as fileobj:
    for line in fileobj:
       for ch in line:
           #Getting ascii values of the char
           tab_ascii_chars.append(ord(ch))

i=0
while i < len(tab_ascii_chars):
    if tab_ascii_chars[i] == 226 and tab_ascii_chars[i+1] == 128 and tab_ascii_chars[i+2] == 131: # if tab
        final_binary += "0"
        i += 3
    elif tab_ascii_chars[i] == 32: #if space
        final_binary += "1"
        i += 1
    else:
        print i
        print tab_ascii_chars[i]
        print tab_ascii_chars[i+1]
        print tab_ascii_chars[i+2]
        raise Error("oops :/")
        
#Outputs the final result
print final_binary

This is the output that we get after running the script :

00001010000010010000100101110000011010010110001101101111010000110101010001000110000010100000101000001001000010010101001101000101010001010010000001010000010101010100001001001100010010010100001100100000010100100100010101000011010011110101001001000100010100110010000000100110001000000100001001000001010000110100101101000111010100100100111101010101010011100100010000100000010100100100010101010000010011110101001001010100000010100000100100001001001101010011000000110000001100000010000001000110011011110111001001100010011001010111001100100000010000010111011001100101001011000010000001010000011010010111010001110100011100110110001001110101011100100110011101101000001011000010000001010000010000010010000000110001001101010011001000110001001100110000101000001001000010010111000001101001011000110110111101000011010101000100011001111011011011100110111101110100010111110110000101101100011011000101111101110011011100000110000101100011011001010111001101011111011000010111001001100101010111110110001101110010011001010110000101110100011001010110010001011111011001010111000101110101011000010110110001011111001100010011011100111000011001000011011100110010001100000011001000110101001100100110000101100110001100010110000101100110001100100011100100110011001101100011100101100101001100010011010100110100011001010110001101100001001100100011001101100001001110010011010101111101000010100000100100001001

Then, we convert the binary to ascii and we got the flag !

		picoCTF

		SEE PUBLIC RECORDS & BACKGROUND REPORT
		5000 Forbes Ave, Pittsburgh, PA 15213
		picoCTF{not_all_spaces_are_created_equal_178d720252af1af29369e154eca23a95}

## TL;DR
The file contains different types of whitespaces (spaces and tabulation) which is a binary message
Convert it to ascii and you get the flag.

## Flag
The flag is **picoCTF{not_all_spaces_are_created_equal_178d720252af1af29369e154eca23a95}**
___
<a rel="license" href="http://creativecommons.org/licenses/by-nc-nd/4.0/"><img alt="Creative Commons License" style="border-width:0" src="https://i.creativecommons.org/l/by-nc-nd/4.0/88x31.png" /></a><br />This work is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by-nc-nd/4.0/">Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License</a>.