Hit or Miss
Hard 40 ptsA photo-sharing site caches image responses per URL. Whether a given private album cover is already cached leaks whether someone recently viewed it — a fast HIT means yes, a slow MISS means no. The log below probes a set of album ids; exactly one is warm. That warm id points to the album whose cover embeds the flag.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
Read the timings. Five requests, four slow, one fast — the fast one was already in the cache.
Hint 2
'Already cached' means someone viewed it recently. That is the album of interest.
Hint 3
The flag is the token attached to the cover of the album that returned a fast HIT.
The artifact
GET /cover/album-8801 304 MISS 198 ms
GET /cover/album-8802 304 MISS 211 ms
GET /cover/album-8803 200 HIT 6 ms X-Cache: HIT Age: 41
GET /cover/album-8804 304 MISS 205 ms
GET /cover/album-8805 304 MISS 187 ms
--- album-8803 metadata (fetched via the warm cover) ---
{"album":"8803","owner":"privé","caption":"nm{a_hit_is_a_leak}"}
Only 8803 was warm — because someone had just looked at it. The timing told you which.