Log Exfil #239

Solving anonymously — your submission still gets judged, but points and streaks need an account. Sign in or register to keep your streak.

A web server's access log for the last hour: 10.0.2.31 - - [14/Nov/2023:22:13:29 +0000] "GET /api/users HTTP/1.1" 200 3658 10.0.0.45 - - [14/Nov/2023:22:13:38 +0000] "GET /login HTTP/1.1" 200 4966 10.0.1.9 - - [14/Nov/2023:22:13:56 +0000] "GET /api/health HTTP/1.1" 200 3902 10.0.0.45 - - [14/Nov/2023:22:13:59 +0000] "GET /robots.txt HTTP/1.1" 200 1238 10.0.2.31 - - [14/Nov/2023:22:14:26 +0000] "GET /favicon.ico HTTP/1.1" 404 3065 10.0.1.9 - - [14/Nov/2023:22:14:55 +0000] "GET /login HTTP/1.1" 200 280 192.168.1.14 - - [14/Nov/2023:22:14:57 +0000] "GET /assets/app.js HTTP/1.1" 200 1873 10.0.0.45 - - [14/Nov/2023:22:15:20 +0000] "GET /login HTTP/1.1" 200 3372 10.0.2.31 - - [14/Nov/2023:22:15:46 +0000] "GET /assets/app.js HTTP/1.1" 200 2056 192.168.1.14 - - [14/Nov/2023:22:16:07 +0000] "GET /index.html HTTP/1.1" 200 3950 10.0.0.12 - - [14/Nov/2023:22:16:29 +0000] "GET /api/users HTTP/1.1" 200 1815 10.0.2.31 - - [14/Nov/2023:22:16:48 +0000] "GET /favicon.ico HTTP/1.1" 304 2847 192.168.1.14 - - [14/Nov/2023:22:16:54 +0000] "GET /favicon.ico HTTP/1.1" 200 4320 10.0.2.31 - - [14/Nov/2023:22:17:07 +0000] "GET /api/status HTTP/1.1" 200 1636 192.168.1.14 - - [14/Nov/2023:22:17:18 +0000] "GET /robots.txt HTTP/1.1" 404 2464 192.168.1.14 - - [14/Nov/2023:22:17:40 +0000] "GET /index.html HTTP/1.1" 200 4696 203.0.113.77 - - [14/Nov/2023:22:17:50 +0000] "GET /beacon?d=YXVhY217emVicmFfc2hyaW1wMzh9 HTTP/1.1" 200 1364 10.0.2.31 - - [14/Nov/2023:22:18:01 +0000] "GET /api/users HTTP/1.1" 200 661 10.0.2.31 - - [14/Nov/2023:22:18:26 +0000] "GET /index.html HTTP/1.1" 404 2500 192.168.1.14 - - [14/Nov/2023:22:18:51 +0000] "GET /assets/app.js HTTP/1.1" 200 1159 10.0.0.12 - - [14/Nov/2023:22:18:52 +0000] "GET /api/users HTTP/1.1" 200 1724 10.0.0.12 - - [14/Nov/2023:22:19:06 +0000] "GET /index.html HTTP/1.1" 304 4905 192.168.1.14 - - [14/Nov/2023:22:19:35 +0000] "GET /api/health HTTP/1.1" 200 1670 10.0.0.12 - - [14/Nov/2023:22:19:54 +0000] "GET /api/status HTTP/1.1" 200 1712 10.0.2.31 - - [14/Nov/2023:22:20:23 +0000] "GET /index.html HTTP/1.1" 200 3213 192.168.1.14 - - [14/Nov/2023:22:20:53 +0000] "GET /robots.txt HTTP/1.1" 304 3953 192.168.1.14 - - [14/Nov/2023:22:21:17 +0000] "GET /assets/app.js HTTP/1.1" 304 1702 10.0.0.12 - - [14/Nov/2023:22:21:21 +0000] "GET /index.html HTTP/1.1" 200 1659 192.168.1.14 - - [14/Nov/2023:22:21:24 +0000] "GET /index.html HTTP/1.1" 304 3840 10.0.0.45 - - [14/Nov/2023:22:21:25 +0000] "GET /index.html HTTP/1.1" 200 2676 10.0.0.12 - - [14/Nov/2023:22:21:28 +0000] "GET /api/status HTTP/1.1" 200 2947 10.0.0.45 - - [14/Nov/2023:22:21:36 +0000] "GET /api/users HTTP/1.1" 200 3340 192.168.1.14 - - [14/Nov/2023:22:22:00 +0000] "GET /api/health HTTP/1.1" 200 443 10.0.0.45 - - [14/Nov/2023:22:22:07 +0000] "GET /assets/app.js HTTP/1.1" 200 1317 10.0.0.12 - - [14/Nov/2023:22:22:29 +0000] "GET /login HTTP/1.1" 200 2343 192.168.1.14 - - [14/Nov/2023:22:22:30 +0000] "GET /robots.txt HTTP/1.1" 200 760 10.0.1.9 - - [14/Nov/2023:22:22:47 +0000] "GET /login HTTP/1.1" 304 4293 10.0.0.45 - - [14/Nov/2023:22:23:12 +0000] "GET /robots.txt HTTP/1.1" 404 3205 10.0.1.9 - - [14/Nov/2023:22:23:39 +0000] "GET /api/users HTTP/1.1" 404 1920 10.0.2.31 - - [14/Nov/2023:22:23:47 +0000] "GET /robots.txt HTTP/1.1" 200 2372 10.0.0.12 - - [14/Nov/2023:22:23:49 +0000] "GET /api/users HTTP/1.1" 404 2430 10.0.0.12 - - [14/Nov/2023:22:23:58 +0000] "GET /api/users HTTP/1.1" 200 4480 10.0.0.45 - - [14/Nov/2023:22:24:07 +0000] "GET /api/health HTTP/1.1" 404 4046 10.0.0.45 - - [14/Nov/2023:22:24:28 +0000] "GET /api/health HTTP/1.1" 304 1706 10.0.0.12 - - [14/Nov/2023:22:24:45 +0000] "GET /index.html HTTP/1.1" 200 4180 192.168.1.14 - - [14/Nov/2023:22:24:57 +0000] "GET /favicon.ico HTTP/1.1" 200 479 10.0.2.31 - - [14/Nov/2023:22:25:06 +0000] "GET /login HTTP/1.1" 304 548 One of these requests is exfiltrating data. Find it and decode the payload to recover the flag.