Insanity 2 - OSINT/Misc

Points: 250 | Difficulty: Easy | Author: x03e | Flag: 0xfun{d1sc0rd_1ns4nt1y_2_3mb3d3d_1ns1d3_rul3s} | Solved by: Smothy @ 0xN1umb

what we got

Challenge description:

Take a look around the Discord server and hopefully you'll find something interesting.

same Discord guild from Insanity 1. gotta look harder this time.

the solve

so after getting jebaited by the fake flag in Insanity 1 (the base64 channel topic lmao), i knew the author was sneaky.

"look around the Discord server" = check everything that isn't obvious. first thing i did was pull all channel data, roles, emojis, guild info - nothing stood out.

then i looked at the #rules channel. the rules embed had this suspicious wall of Discord spoiler tags (||text||) in the description. looked like just whitespace but when you dump the raw JSON...

# the embed description ends with:
'||\u200b||||\u200b||||\u200b||...(200+ spoiler tags with zero-width spaces)...|| _ _ _ _ _ _  0xfun{d1sc0rd_1ns4nt1y_2_3mb3d3d_1ns1d3_rul3s}'

the flag was hidden AFTER a massive wall of ||zero-width-char|| spoiler tags. in the Discord client this renders as a tiny clickable spoiler that looks like nothing. you'd never notice it just reading the rules normally.

the trick:

1. || = Discord spoiler syntax
2. \u200b = zero-width space (invisible character)
3. stack 200+ of these together = creates invisible padding that pushes the real content way off-screen
4. the flag sits at the very end, hidden behind the spoiler wall

how to find it: either use the Discord API to get raw message data, or click the spoiler in Discord and scroll right. the API way is cleaner:

curl -s -H "Authorization: TOKEN" \
  "https://discord.com/api/v10/channels/RULES_CHANNEL_ID/messages" | python3 -c "
import json, sys
msgs = json.load(sys.stdin)
for m in msgs:
    for e in m.get('embeds',[]):
        print(repr(e.get('description','')))
"

ngl this was clever. hiding stuff in embed descriptions behind invisible spoiler walls is a nice touch. the rules is the one place everyone looks but nobody actually reads carefully.

flag

0xfun{d1sc0rd_1ns4nt1y_2_3mb3d3d_1ns1d3_rul3s}

smothy out ✌️