--- title: picoCTF 2019 - [Forensic] WhitePages (250 points) author: Maltemo tags: CTF, picoCTF, Forensic, Binary, Whitespace --- picoCTF 2019 - [Forensic] WhitePages (250 points) === Written by [Maltemo](https://twitter.com/Maltemo), member of team [SinHack](https://sinhack.blog/) in collaboration with [SaladeTomateOnion](https://twitter.com/saladtomat0nion) team. [TOC] ___ ## Statement of the challenge ### Description I stopped using YellowPages and moved onto WhitePages... but the page they gave me is all blank! ### File ``` whitepages.txt ``` ## Analyzing the file The file is a text file, with only one line of spaces and tabulations. After searching in the direction of the tool called [snow](https://sbmlabs.com/notes/snow_whitespace_steganography_tool/), I found that it was a dead-end. Next step was to check if the data contained in the file wasn't just binary. :::info **Fun fact** : [0p62No2]() sent me a link to the [WhiteSpace language](https://en.wikipedia.org/wiki/Whitespace_%28programming_language%29), which led me to think about spaces and tabs to store binary data. ::: ## Python Algorithm to extract the data ```python= tab_ascii_chars = [] final_binary = "" #Reading the file with open('whitepages.txt','r') as fileobj: for line in fileobj: for ch in line: #Getting ascii values of the char tab_ascii_chars.append(ord(ch)) i=0 while i < len(tab_ascii_chars): if tab_ascii_chars[i] == 226 and tab_ascii_chars[i+1] == 128 and tab_ascii_chars[i+2] == 131: # if tab final_binary += "0" i += 3 elif tab_ascii_chars[i] == 32: #if space final_binary += "1" i += 1 else: print i print tab_ascii_chars[i] print tab_ascii_chars[i+1] print tab_ascii_chars[i+2] raise Error("oops :/") #Outputs the final result print final_binary ``` This is the output that we get after running the script : ``` 00001010000010010000100101110000011010010110001101101111010000110101010001000110000010100000101000001001000010010101001101000101010001010010000001010000010101010100001001001100010010010100001100100000010100100100010101000011010011110101001001000100010100110010000000100110001000000100001001000001010000110100101101000111010100100100111101010101010011100100010000100000010100100100010101010000010011110101001001010100000010100000100100001001001101010011000000110000001100000010000001000110011011110111001001100010011001010111001100100000010000010111011001100101001011000010000001010000011010010111010001110100011100110110001001110101011100100110011101101000001011000010000001010000010000010010000000110001001101010011001000110001001100110000101000001001000010010111000001101001011000110110111101000011010101000100011001111011011011100110111101110100010111110110000101101100011011000101111101110011011100000110000101100011011001010111001101011111011000010111001001100101010111110110001101110010011001010110000101110100011001010110010001011111011001010111000101110101011000010110110001011111001100010011011100111000011001000011011100110010001100000011001000110101001100100110000101100110001100010110000101100110001100100011100100110011001101100011100101100101001100010011010100110100011001010110001101100001001100100011001101100001001110010011010101111101000010100000100100001001 ``` Then, we convert the binary to ascii and we got the flag ! ``` picoCTF SEE PUBLIC RECORDS & BACKGROUND REPORT 5000 Forbes Ave, Pittsburgh, PA 15213 picoCTF{not_all_spaces_are_created_equal_178d720252af1af29369e154eca23a95} ``` ## TL;DR The file contains different types of whitespaces (spaces and tabulation) which is a binary message Convert it to ascii and you get the flag. ## Flag The flag is **picoCTF{not_all_spaces_are_created_equal_178d720252af1af29369e154eca23a95}** ___ <a rel="license" href="http://creativecommons.org/licenses/by-nc-nd/4.0/"><img alt="Creative Commons License" style="border-width:0" src="https://i.creativecommons.org/l/by-nc-nd/4.0/88x31.png" /></a><br />This work is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by-nc-nd/4.0/">Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License</a>.