back to home

WHEELER, pt. 1 Challenge #2 - Sewer

This challenge can be found when Eli redirects all sewer traffic and creates a brown alert.

The Setup

At Chalon Sombreo Ski Resort, the pipes aren’t the only thing leaking, it looks like the developers’ code is springing leaks too.

Can you trace the drips in their system and uncover the hidden valve control?

We are given a URL to a dashboard.

The Docs

The first thing I do every time when given a webpage as a challenge is right-click and View Page Source.

Doesn't miss this time, there is an HTML comment near the bottom:

<!-- TODO: Developer note: for internal API docs check /docs -->

Nice! Checking-out the /docs page, we see an "admin" route called /sewer/valve_control. You can either use the "Try it out" button or go to that page directly, and the flag is there on the page.