TCS HackQuest Season 10 — Round 1: Walkthrough

Every year, TCS organizes HackQuest, an ethical hacking and cybersecurity competition for students across India. Designed in a Capture the Flag (CTF) format, the event challenges participants to solve security-based tasks and uncover hidden flags. High-performing participants earn prizes and may also receive opportunities to join TCS’s Cyber Security Unit.

TCS HackQuest follows a three-round structure:
Round 1 is an online Capture the Flag (CTF) with beginner to expert challenges; shortlisted participants move to -
Round 2, an online, remotely proctored advanced challenge requiring cameras on;
the Final round is an in-person event at a TCS location, culminating in potential job offers for top performers, all focused on ethical hacking skills.

Round 1: Online CTF

• Format: Online Capture the Flag (CTF) competition.
• Content: Cybersecurity challenges across three difficulty levels: Beginner, Intermediate, and Expert.

Round 1 Challenge Write-ups

This section documents the challenges I successfully solved during Round 1 of TCS HackQuest.

Challenges solved: 5 out of 10
Points obtained: 900

Challenge #1: Noise (100 points)

Approach (Step by Step):

1. A .opt file is given to us. This is a non-human-readable filetype. Find the file type. It says data.

Command:

file c911caFec7.opt

2. Look for any human readable strings using the strings command.

Command:

strings c911caFec7.opt > strings.txt

3. Use a general-purpose regex to find the flag using grep command.

Command:

grep -E “flag\{|CTF\{|[A-Za-z0–9_]{10,}” strings.txt

4. Found the flag string!

Challenge #2: Hidden Layers (100 points)

Approach (Step by Step):

1. An image is provided. Based on the description, the challenge looks like a classic example of Steganography.

2. Use an online Steganography Decoder, and get the flag string.

Steganography Decoder

Challenge #3: Seeds of Time (300 points)

Approach (Step by Step):

1. I couldn’t download the file associated with the level on Chrome browser. The error message displayed suggested trying again on a different browser. I opened Burp and used Chromium and the file was downloaded successfully.
2. Analyzing the encoder code, it is found that the seed being used is essentially ‘int(time.time())’.
3. A keystream is generated using random.random() and the flag is encrypted using XOR (cipher[i] = FLAG[i] ^ keystream[i]).
4. The security flaw here is that the time.time() has 1 second resolution, making the seed predictable. This means the keystream can be recreated if the seed is known or guessed within a small-time window.
5. Generate the keystream by reversing the XOR operation.
6. Since the seed is based on Unix time, the encryption likely happened recently. Tried a range of 24 hours (86400 seconds)
7. For each possible timestamp in the 24-hour range:

• Seed the PRNG with the candidate timestamp.
• Generate a keystream of the same length as the ciphertext using int(random.random() * 256).
• XOR the generated keystream with the ciphertext to produce a potential plaintext.
• Attempt to decode the resulting bytes to ASCII text.
• Check if the decoded text matches the expected flag format (typically containing {} for CTF flags).

8. Once the correct seed is found:

• The keystream matches the one used during encryption.
• XORing with the ciphertext recovers the original flag.
• No additional transformations are necessary.

Python Script:

Output:

Challenge #4: Dot — Trace (300 points)

Approach (Step by Step):

1. Open the file or view it in a terminal. It appears unreadable and mostly consists of dots and invisible characters (spaces and tabs).
2. From the challenge description and recovered encoder logic, it is clear that:

• dots (.) are noise
• spaces represent binary 0
• tabs represent binary 1
• newlines separate encoded characters

Thus, only whitespace matters.

Get Arnav Vaidya’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

3. The recovered encoder:

• converts each character to ASCII converts ASCII to binary (without fixed 8-bit padding)
• encodes:

1 as a tab

0 as a space

• pads output heavily with dots and spreads data across multiple lines

Decoder Python script:

Output:

Challenge #5: Unfair Flip (100 points)

Approach (Step by Step):

1. Open DevTools to inspect the code. It seems that the code forces at least one Tails every time.
2. While scrolling through the console, I noticed the game code defined a function named: hiddenFlag() .
3. Simply open Console and enter the following JavaScript code.

window.coins = [“H”,”H”,”H”];
window._hiddenFlag()

3. The flag will be received!

Result: Selected for the next round!

📬 Contact Me

If you’d like to discuss cybersecurity, ethical hacking, CTF challenges, or collaboration opportunities, feel free to reach out:

• LinkedIn: https://www.linkedin.com/in/arnavaidya/
• GitHub: https://github.com/arnavaidya