Editorial for DMOJ Capture The Flag '20 F2 - Queries & Strings
Submitting an official solution before solving the problem yourself is a bannable offence.
The name of the problem should have hinted that you should look closing at
query strings (this would have been returned by Google if you had searched for
& Strings). Thus, we should look closely at the query strings in the log. The query strings are:
?api_token=Z2V0dGluZyB0aGVyZSE ?api_token=bm9wZQ ?api_token=bWF5YmUuLi4 ?api_token=Y3Rme3F1M3J5X3N0cmluZ19jcjNkM250aTRsc180cjNfc2FkfQ
These look suspiciously like base64 encoded strings, and if we decode them, we get the flag in the last one.