Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
Extract a safe ZIP-formatted APK fixture and analyze the API secret recorded in its Android resources. No real device or app is used.
evidence/app.apk can be extracted with unzip
Inspect res/values/strings.xml
Decode the api_secret_b64 value with base64 -d