PascalCTF 2026 - JShit

Challenge Overview

Challenge Name: JShit Category: Web Flag: pascalCTF{1_h4t3_j4v4scr1pt_s0o0o0o0_much}

🔍 Analysis

The challenge provided a single HTML file containing a heavily obfuscated JavaScript script using JSFuck (using only 6 characters: []()!+).

The Source Code

The HTML contained a script block with the obfuscated code:

1
<script id="code">
2
    [][(![] + [])[+!+[]] + (!![] + [])[+[]]][([][(![] + [])...
3
</script>

🔓 Solution

1. Decoding JSFuck: The JSFuck code evaluates to a JavaScript function. We can decode it by pasting the characters into a browser console (removing the final () call to see the function source instead of executing it) or using a dedicated decoder (https://www.dcode.fr/jsfuck-language).

2. Decoded Logic: The logic hidden within the obfuscation was revealed to be:

   1
   () => {
   2
     const pageElement = document.getElementById('page');
   3
     // Checks for a cookie named 'flag'
   4
     const flag = document.cookie.split('; ').find(row => row.startsWith('flag='));
   5
   
   6
     // Compares the cookie value against the hardcoded flag
   7
     const pageContent = `<div class="container">
   8
       <h1 class="mt-5">Welcome to JSHit</h1>
   9
       <p class="lead">${
   10
         flag && flag.split('=')[1] === 'pascalCTF{1_h4t3_j4v4scr1pt_s0o0o0o0_much}'
   11
           ? 'You got the flag gg'
   12
           : 'You got no flag yet lol'
   13
       }</p>
   14
     </div>`;
   15
   
   16
     pageElement.innerHTML = pageContent;
   17
     console.log("where's the page gone?");
   18
     document.getElementById('code').remove(); // Deletes the script tag
   19
   }

3. Extracting the Flag: The flag is hardcoded directly in the comparison within the script.

Flag

pascalCTF{1_h4t3_j4v4scr1pt_s0o0o0o0_much}