Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
scan.json is generated from the FLAG injected at startup. Select the verification host with open 443/tcp and hex-decode review_fragments to recover the flag.
Inspect scan.json and identify the target record
select the verification host with open 443/tcp and hex-decode review_fragments
Verify that the reconstructed value has FLAG{...} format