Hollow Houses

Summary

The site is a maze of interlinked rooms with no site map and nothing useful in the headers. The route through it is a Morse message hidden in the whitespace of a poem, which names the one room holding the flag.

1. The maze

Every room (/atrium/, /ossuary/, /wellspring/, /mirror/, and around fifty more) links to roughly 50 others, so blind crawling gives no gradient.

robots.txt is the entry point:

User-agent: *
Disallow: /internal-monitor/
Disallow: /relay-status/

# the obedient have been answered.

The comment is an invitation to visit what is disallowed.

2. The nudge

One room carries the HTML comment:

<!-- not every word is the colour it appears to be. select all, if you must. -->

Several rooms style text at near-background colours, so a select-all or a tag-stripping fetch is needed to read them. A small crawler that saved each room and printed its comments, stripped text, and any csaw{REDACTED} match did the walking:

curl -sS -o "$N.html" "https://hollow-houses.ctf.csaw.io/$P"
grep -o '<!--[^>]*-->' "$N.html"
grep -oiE 'csaw\{[^}]*\}' "$N.html"

3. The message

/wellspring/ holds a <pre class="elegy"> poem. The words are filler; the gaps are the payload. Per line, each inter-word gap is one Morse symbol — a single space is a dot, two or more spaces a dash — one line is one letter, and a blank line is a word break:

sym = "".join("-" if len(m.group(1)) > 1 else "."
              for m in re.finditer(r"(?<=\S)( +)(?=\S)", ln))

Decoded: THE FLAG LIES WAITING IN THE SANCTUM

4. The room

/sanctum/ carries the flag plainly in <span class="flag breathe"> — no further trick once you know which of the fifty-odd doors to open.

Scripts: ~/ctf/work/hollow/ (f.sh, morse.py, poem2.py)