The magic word

Ask and you shall receive...that is as long as you use the magic word.

URL: https://magicword.2020.chall.actf.co/

Recon

If we look at the source of the page we see the following javascript:

<script>
    var msg = document.getElementById("magic");
    setInterval(function() {
        if (magic.innerText == "please give flag") {
            fetch("/flag?msg=" + encodeURIComponent(msg.innerText))
                .then(res => res.text())
                .then(txt => magic.innerText = txt.split``.map(v => String.fromCharCode(v.charCodeAt(0) ^ 0xf)).join``);
        }
    }, 1000);
</script>

We simply opened the Developer tools and changed the text of the magic element to please give flag, the javascript then will give us the flag.

Code

actf{1nsp3c7_3l3m3nt_is_y0ur_b3st_fri3nd}