Webhack Solutions

OSINT, Easy, 50 pts

HITP{hackitup_X_webhackacademy}

The challenge links only to the Instagram account @webhackacademy. Most of its posters carry a QR code, but every scannable one just points to https://academy.webhacksolutions.com/, a plain course-signup page with nothing hidden in its HTML, headers, or EXIF. One poster carries a visibly different, denser QR that doesn't decode with any standard tool — a screenshot of an Instagram post isn't clean enough source material for a damaged/dense code, and it turned out to be a dead end rather than the real lead.

The actual path is the collaboration post between Sea of Secrets CTF and @webhackacademy: a comment thread under it names a coupon code, HACKITUP15, advertised as a "Special 15% discount" for the academy. Registering on https://academy.webhacksolutions.com/ with that code reveals the flag.

Two things worth noting for next time: a comment reading HACKITUP15 from a throwaway-looking account (shadow_cache.exe) was initially dismissed as bait, since it stood out as an odd thing to post in a comment section — it was in fact the real answer. And the dense "AI content"-tagged QR that resisted every decode attempt was a red herring, not a damaged real code; time spent trying to repair it (grid resampling, erasure decoding, format-info BCH correction) didn't pay off.