Framed
This is a challenge that I have created for the Cybernight 2025 CTF competition, under the Web category.
It was based on a real-time collaborative pixel canvas, using the following open-source project:
When loading the page, the server sends the initial canvas as a PNG.
Then the client connects to a WebSocket to receive all live pixel updates in real time.
The challenge
The original PNG looks like a flat gray canvas.
However, there are two slightly different gray tones:
- the main color:
#888888 - a barely different shade:
#898888
The difference is only one value apart in the RGB space so it's completely invisible to the naked eye.
But those slightly lighter pixels actually draw the entire flag, hidden inside the canvas.
Solving methods
The solution was simply to amplify the contrast between the two shades.
You could use any method:
- open the PNG in GIMP/Photoshop and boost the contrast,
- apply a threshold filter,
- or write a small script to map:
#888888→ black#898888→ white
Once processed, the hidden pattern becomes perfectly readable, revealing the flag as a pixel-art message.
🚫 the decoy
On the live canvas, a fake account slowly started drawing a fake flag pixel by pixel.
Many players thought the intended solution was to wait until it was fully written.
But it was a decoy.
The fake flag was invalid — it was only there to mislead players and waste time.
The real flag was only inside the initial PNG sent when loading the page.