initial commit

de-monne-slayer/hard-kept-secrets/README.md

@@ -0,0 +1,21 @@
+# Hard Kept Secrets
+
+**Category:** De Monne Slayer
+
+**Points:** 20
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonneslayer.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+De Monne Financial has had several security incidents revolving around the latest version of their Android mobile application. Sensitive user data is being compromised left and right. De Monne is unsure how DEADFACE has access to their API. It's too early to tell if they compromised a password - let's first check if there are any hardcoded secrets in the app.
+
+Your task is to recover the internal API token from the APK. Submit the token as the flag. Example: `deadface{2GFEwQvPVIMLJmjGYHgKFWkmpuhrjEnSewMrFRyVMEQ=}`
+
+[Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/demonneslayer/app-release.zip)\<br>
+\<sup>SHA256:`5530926b2e564615285d15674ddb21c316f673d7d240f9fcfa36c6afb99f5c0c`\</sup>
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)