PicoCTF Vault Door Training Writeup — Read a Password from Java Source

#security #ctf #beginners

The vault door's Java source code (VaultDoorTraining.java) is provided directly — no need to decompile anything. The checkPassword method compares user input to a hardcoded string in the file: you just have to read it.

Platform: picoGym
Category: Rev Eng
Points: 100 pts
Difficulty: Beginner
Tools: javacjavatext editor

Challenge description

The challenge provides a complete source file directly, VaultDoorTraining.java, which simulates a vault door. Once compiled and run, the program asks the user to enter a password to "open" the door:

$ java VaultDoorTraining
Enter vault password:

No binary to disassemble, no bytecode to decompile — this is the softest possible starting point of the "Vault-Door" series: the source code is readable as-is.

Step 1 — Read the code

We open VaultDoorTraining.java in a text editor. The overall structure looks like this:

public class VaultDoorTraining {
    public static void main(String args[]) {
        VaultDoorTraining vaultDoor = new VaultDoorTraining();
        Scanner scanner = new Scanner(System.in);
        System.out.print("Enter vault password: ");
        String userInput = scanner.next();
        String input = userInput.substring(0);
        if (vaultDoor.checkPassword(input)) {
            System.out.println("Access granted.");
        } else {
            System.out.println("Access denied!");
        }
    }

    public boolean checkPassword(String password) {
        // ... the verification logic is here
    }
}

We immediately spot the entry point: the checkPassword(String password) method, called right after user input. This is what decides whether access is granted.

Step 2 — Find the comparison

Inside checkPassword, there's no complex logic: just a simple comparison between the user input and a string literal hardcoded in the file.

public boolean checkPassword(String password) {
    return password.equals("crackthevaultpassword123");
}

The expected password isn't encrypted, encoded, or obfuscated in any way — it's written plainly in the source code, like an ordinary variable.

Step 3 — Extract the password

We just have to copy the string literal found inside .equals("..."). This value is the password the program expects — and in this challenge, once entered correctly, the program directly prints the flag in picoCTF{...} format as its success message.

Step 4 — Verify (optional)

To confirm, we compile and run the program locally with the JDK, then enter the password we found:

$ javac VaultDoorTraining.java
$ java VaultDoorTraining
Enter vault password: crackthevaultpassword123
Access granted.
picoCTF{...}

The success message confirms that reading the source code was enough — no advanced reverse engineering tools were needed for this first level of the series.

🚩 picoCTF{ flag intentionally hidden }

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

Hardcoding a secret in source code (even compiled) is never safe — anyone with access to the binary or bytecode can decompile it and read the value in plaintext
This "Vault-Door" series is specifically designed to illustrate, step by step, checks that get increasingly hard to read at a glance
The reflex of "search for .equals( and suspicious string literals" is one of the very first static analysis tools in reverse engineering

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.

DEV Community