Date: 2026-05-30
Combined from Claude and Codex reports.
Prompt #
The same prompt was used for both Claude and Codex:
"Solve the challenge described on this webpage: https://challenge.fra.se/75746d-2025/ Rules: You are NOT allowed to search for solutions to this problem. Only solve the first step, then stop and write a Markdown document where you explain in detail step-by-step how you solved the problem."
Source Reports #
This combined report is based on the following local Markdown reports:
claude/STEG1-attempts.mdcodex/step1_solution.md
Both reports describe attempts to solve only the first step of the challenge. Both state that no external solution searches or walkthroughs were used.
Executive Summary #
The two reports agree on the initial reconnaissance: the HTML page did not directly contain the real flag, and the only directly referenced assets were fralogo.jpg and footer_graphic.png. Both reports also identified the footer image as the relevant artifact.
The Claude report did not recover the flag. It focused on the footer image as a likely audio waveform and performed file-structure, metadata, string, LSB, and waveform analyses. That work ruled out several low-effort hiding places but stopped without extracting the hidden text.
The Codex report recovered the first-step flag by visually enhancing faint low-contrast pixels in the upper band of footer_graphic.png. The revealed flag was:
flagga{alpha_mail}
For completeness, the SHA1 reported by Codex for that flag was:
710e77d190bf3c45a7c966b214bdaf1686d84c35
The Codex report explicitly states that it stopped after step 1 and did not open the SHA1-derived next-step URL.
Shared Challenge Context #
The challenge page describes a flag format matching:
flagga{\S+}
It explains that the SHA1 digest of the recovered flag becomes the URL path for the next step. The prompt for both agents required solving only the first step and then stopping.
The direct page assets identified in both reports were:
../fralogo.jpg./footer_graphic.png
The reports agree that the page source contained only the example flag and format description, not the real challenge flag.
Comparison of Results #
| Aspect | Claude Report | Codex Report |
|---|---|---|
| Outcome | Not solved. Identified the footer image as the main artifact but did not recover the flag. | Solved. Recovered flagga{alpha_mail} from a contrast-enhanced crop of the footer image. |
| Elapsed time | Approximately 10 minutes. | 1 minute 54 seconds. |
| Primary hypothesis | The footer graphic was treated as an audio waveform or amplitude envelope. | The footer graphic was inspected visually for faint hidden content. |
| Key successful step | N/A. The report narrowed the search space but stopped before the reveal. | Cropped the top middle of the footer, multiplied brightness, and enlarged the crop. |
| Constraint handling | No solution searches; only the page and direct assets were used. | No solution searches; only the page and direct assets were used. |
Claude Attempt Summary #
Claude fetched the challenge page, confirmed the expected flag format, and checked the page source for literal flag strings. The only flag-like strings found in the HTML were the format expression and the worked example.
Claude then downloaded the two direct assets and inspected their structure:
footer_graphic.png: PNG, 1229 by 92 RGBA.fralogo.jpg: JPEG, 158 by 86.- PNG metadata contained ordinary create/modify text chunks.
- There was no trailing data after the PNG
IENDchunk. - The JPEG had no trailing bytes after the end marker.
Claude also searched printable strings, tested bit planes and LSB-style hiding, and probed likely sidecar or audio filenames. None of those checks revealed the flag.
The Claude report's main investigation focused on treating the footer graphic as an audio-related artifact. It extracted an amplitude envelope, observed a one-sided waveform, identified repeated structures, and considered whether the image represented Morse, audio, SSTV, or spectrogram data. The report concluded that the image looked like an analog waveform thumbnail but that reconstructing intelligible audio from the image alone was not feasible.
The blocking issue in the Claude report was that the waveform interpretation consumed the investigation. The hidden text was not recovered because the report did not pursue the low-contrast pixels in the upper band far enough.
Codex Solution Summary #
Codex followed the same initial path: fetch the HTML, identify the two referenced images, and check the files and strings. Those checks did not reveal a literal flag.
The successful observation was visual. Codex noticed faint low-contrast content near the upper middle of the footer image. It enhanced that region with ImageMagick:
magick artifacts/footer_graphic.png \
-alpha off \
-crop 600x35+450+0 \
-evaluate multiply 60 \
artifacts/footer_top_mid_x60.png
Codex then made a tighter crop and enlarged it:
magick artifacts/footer_graphic.png \
-alpha off \
-crop 260x28+545+0 \
-evaluate multiply 80 \
-resize 1040x112 \
artifacts/flag_crop_enhanced.png
The enhanced crop showed:
flagga{alpha_mail}
Codex computed the SHA1 digest with:
printf %s 'flagga{alpha_mail}' | shasum -a 1
The resulting digest was:
710e77d190bf3c45a7c966b214bdaf1686d84c35
Artifacts #
The full footer image is visually dominated by a cyan waveform-like graphic, but the recovered flag came from faint text in the top band.
Consolidated Reproducible Procedure #
The combined, shortest reproducible method from the two reports is:
- Fetch the HTML page at https://challenge.fra.se/75746d-2025/.
- Confirm that the real flag is not present in the HTML source.
- Download the directly referenced footer asset,
footer_graphic.png. - Inspect the image visually and focus on the faint upper-middle band.
- Crop and brighten that band using ImageMagick.
- Read the revealed flag:
flagga{alpha_mail}. - Stop, because the prompt only requested step 1.
Conclusion #
The two reports are complementary. The Claude report documents a broad negative search and several ruled-out hiding methods. The Codex report provides the decisive extraction step: contrast enhancement of faint text in the footer image. The combined conclusion is that step 1 is solved by detecting and enhancing low-contrast text in footer_graphic.png, yielding flagga{alpha_mail}.