I am creating my own problems that people have to solve and I want to make a grader check if a user put in the right answers and then reward them with a flag.

My code for one particular problem:

from Crypto.Cipher import AES
from binascii import hexlify
from binascii import unhexlify

password = input("What is the answer to the first question? ")

passwordtwo = input("What is the answer to the second question? ")

message = input("What is the answer to the third question? ")

obj = AES.new(password, AES.MODE_CFB, 'This is an IV456')

ciphertext = obj.encrypt(message)

obj2 = AES.new(passwordtwo, AES.MODE_CFB, 'This is an IV456')

answer = b'c557774c4e5bd1745319b15226e078ef30abcb50f1bd371946ddadffc39a1f56'
flag = b'a2c8b65cda513befb8134c7960bc977946655d485f9ad2'

if (hexlify(ciphertext) == answer):

#first question: I took a major language exam in 2018 - what did I get due to my score? The answer is two words. Format should be ans:<question 1 answer>

#second question: I partook in a competition in my district in 2017 - what was the name of the competition? The answer is three words. Format should be ans: <answer to question 2>

#third question: I was in a competitive club around the time I wrote a book. What did I place and for what event? The answer is four words. Format should be <place>: <event>. Write it out in words

#note that the format is EXTREMELY particular - it has to be exactly the same. Also, everything is lowercase.

This code works as long as users abide exactly to the format I specify. I'm not sure, however, if a user can just find the flag without actually answering the questions. I would think that by making them figure out the passwords themselves it would be impossible to trick the grader. Is this code secure? If not, how can I make this more secure?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.