Decrypt the Spy Beacon: XOR Key Recovery

Repeating-Key XOR — The Classic Spy Cipher

Repeating-key XOR is one of the oldest stream-cipher constructions: a plaintext is XORed byte-by-byte against a short key that cycles repeatedly. If you know (or can guess) any portion of the plaintext, you can recover the key and decrypt everything else.

The Known-Plaintext Attack

All blobs in this lab begin with the ASCII prefix FLAG{ before the secret content. Because you know the first five bytes of plaintext, you can XOR them against the first five bytes of ciphertext to recover the first five bytes of the key. Since the key is short and repeating, those bytes are often all you need.

How to Decode the Blob

You are given a hex-encoded ciphertext. Your workflow:

1. Decode hex → raw bytes: python3 -c "import bytes; print(bytes.fromhex('YOURBLOB'))" or paste into CyberChef's From Hex recipe.
2. Recover the key: XOR the first 5 raw bytes against b'FLAG{' — this reveals the cycling key.
3. Decrypt: XOR the entire ciphertext against the repeating key. In Python: key = b'<recovered>'; ct = bytes.fromhex('YOURBLOB'); print(bytes(c ^ key[i % len(key)] for i, c in enumerate(ct)).decode())
4. Grab the flag: the decrypted plaintext is your flag in FLAG{...} format.

Tools

• CyberChef: chain From Hex → XOR (set key and 'Standard' cycling mode)
• Python 3: one-liner as shown above — no installs needed
• CyberChef online: https://gchq.github.io/CyberChef/