# UIT W4nnaW1n for newbies
## Forensics - External Feature
### Level: Medium

File: https://drive.google.com/file/d/1YYMldQ4gX8PMhjRDmJdP3Kk8BCohtxDf/view?usp=sharing

-So as for the tittle of the challenge its about "External Feature" also its give me the zipped file contains a chrome's data of a user so I think thats the Challenge its told us to look in the extension folder.

-If you're farmiliar with chrome's extension, you'll know where the extension will be stored, if not you can search for it
-So I checked the extension folder and this is what I found
There are 5 extensions, so I check all of them and one by one then I found some thing quite suspicious



There is something isn't right about this function, beside from continuing the program there is a function that send your username and password to another program


continue reading the source file you can see that the Dec() function XOR the string with API key then send it to somewhere else.
So in order to find the flag we just have to decode the string from base64 then decrypt it.
## Flag: W1{s1mpl3_d4t4_3xf1ltr4t10n_v14_t3le}