How do I pass hiddenkeywords
If you’re not afraid of spoilers, let’s go!
Instruments
All levels were completed with Developers tools open on Chrome. There you can look at the html of the page, and admire the response. Some third-party software was also used, but about it a little later, let it remain an intrigue.
Met by clothes
We are greeted by a pleasant site in a dark theme. Pretty standard. Almost immediately we are brought up to date: there are 20 hidden phrases hidden on the site. That’s what we’ll be looking for!
Now let’s take a look inside! I will not give the full page right away, but we will slowly explore the contents. However, I’ll show you the most interesting thing for us so far: there are clues to these hidden words.
<div class="results">
<div class="number clue" data-tippy-content="?">1</div>
<div class="number clue" data-tippy-content="The keyword is here">2</div>
<div class="number clue" data-tippy-content="?">3</div>
<div class="number clue" data-tippy-content="🍪">4</div>
<div class="number clue" data-tippy-content="Inspect this">5</div>
<div class="number clue" data-tippy-content="📈">6</div>
<div class="number clue" data-tippy-content="x-🤖">7</div>
<div class="number clue" data-tippy-content="13th August, 2019">8</div>
<div class="number clue" data-tippy-content="🐸">9</div>
<div class="number clue" data-tippy-content="?">10</div>
<div class="number clue" data-tippy-content="?">11</div>
<div class="number clue" data-tippy-content="bingo">12</div>
<div class="number clue" data-tippy-content="?">13</div>
<div class="number clue" data-tippy-content="ld+json">14</div>
<div class="number clue" data-tippy-content="🔓">15</div>
<div class="number clue" data-tippy-content="Try searching">16</div>
<div class="number clue" data-tippy-content="?">17</div>
<div class="number clue" data-tippy-content="🗺">18</div>
<div class="number clue" data-tippy-content="💡🏠">19</div>
<div class="number clue" data-tippy-content="🎨">20</div>
</div>Hints. Some are obvious, some are not. However, I will not describe the solutions in chronological order, sometimes leaving remarks about how quickly it turned out to solve a particular problem. I spent astronomically 3 days on the entire passage, starting the game on the morning of May 3rd.
First clues
I think many have already guessed at least the fourth word: the liver hints too clearly. But let’s get to cookies, but for now the first step for all SEO is verification robots.txt
Enter the word museum and…
Some pictures
And suddenly decided the first word. Indeed, any SEO run starts with robots.txt
The second task seems more difficult: “The keyword is here”, but this is only at first glance. Let’s take a closer look at the inscription on Hello
<div class="description fadeout" id="desc">
<h1>Hello</h1>
<p>This is a puzzle for technical SEOs.</p>
<p>There are twenty hidden keywords.<span class="likethis">One of them is here.</span> Can you find them?</p>
</div>So, I think it became clearer, namely the strange piece One of them is here.
We sort through all the words here and find the treasured here. The second keyword is with us.
We will find the third word much later, closer to the middle of the investigation, when we will be thrown to a non-existent page with a 404 error code. For this, for example, it is enough to add index.html to the link. For one thing, we will finish with another hypothesis that will not play …
So far, nothing complicated. It’s time to check the cookie. Go to the Developers Tool in Google Chrome, open the Application tab, select Storage-Cookies and our website. As a result, we see something like this:
Let’s try and enjoy! This word, by the way, was found first, even though all the others nearby were also found quickly enough.
The fifth keyword is waiting for us in the console.
A quarter of the way has already been covered.
Let’s learn something new…
The sixth question with a hint 📈 turned out to be the most difficult for me. It was after this word succumbed to me that a page with congratulations looked at me from the other side of the monitor. What I didn’t try to do for this: I also looked among the download graphs, thinking that some special pattern would be added there, for example, in Morse code, and even tried to get something through Googletrends. Measured the work of the site and scripts.
To be honest, a day went by until I wrote to Igor Levashov. For some time we discussed in the chat what the chart could mean. Suddenly, Igor said that perhaps this was some kind of analytics. Google Analytics!!!!
We begin to look at the calls to the analytics.js script – since it is downloaded from the Google website, the probability of its modification is minimal. However, we try most of the lines that seem suspicious – empty.
We look through parameters of requests – too deafly.
Again for an hour we walk around the bush. We look at the work of the script that downloads the Google Analytics script. We look under a magnifying glass, each sneeze is a breakpoint. NOTHING!
<script>
(function(d,r,a,s,t,i,c){d['GoogleAnalyticsObject']=t;d[t]=d[t]||function(){
(d[t].q=d[t].q||[]).push(arguments)},d[t].l=1*new Date();i=r.createElement(a),
c=r.getElementsByTagName(a)[0];i.async=1;i.src=s;c.parentNode.insertBefore(i,c)
})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-145490457-1', 'auto');
ga('send', 'pageview');
</script>I’ve been meditating on this code for about half an hour and…
function(d,r,a,s,t,i,c){d['GoogleAnalyticsObject']=td,r,a,s,t,i,c…
Let’s try! Bingo!
The seventh hint is easy to use on the one hand. In the Network tab, we look at the received files and in hiddenkeywords we find the desired tag:
We check our guess – everything is correct. Let’s move on to the next puzzle. What manipulations with date. I try to send a request “from the past” first – no effect. Google the date – the day of left-handers. We try lefty – again by. Something a bit tricky…
And then the idea comes to mind – what if search the web archive?
It’s not that hard. Now frog! I’m confused… Trying to google something on the subject. First link in SERP: Screaming Frog SEO Spider website crawler – sounds like a plan. We download it after launching the VPN, since for some reason the download is closed for my IP, I suspect it is due to sanctions, we launch it.
We are trying to enter two – past. How so?! I’m trying to figure out what the frog found there.
jericho – and it already works!
There are no further hints. What to do? Well, since the theme of crawlers and spiders has gone, what if we try others? Chronologically, this is exactly what happened. First, a frog, and then 10, and a little later, 12, but more on that later.
We change the User-Agent (this will be enough, but I was ready to wind up more settings) in Chrome, and for this we go to the Network conditions tab. By searching, we find some robots, let’s start with the Googlebot robot.
Tadam!
Tadam! I’ve been noticed!
<div class="description fadeout" id="desc">
<h1>I see you</h1>
<p>Pretending you're Googlebot.</p>
<p>But you're not. <span class="welldonethough">subterfuge.</span> You're not Googlebot.</p>
</div>We try the found word – it was intended.
Half behind. There’s still half left!
Let’s now look at the link. Something is missing. What if we add www? We check the guess and nothing happens. Or is it happening? We climb into our favorite Network tab and see strange things.
A couple of redirects. Suspicious… And I was not mistaken. airbrake is one of the searched words.
Now come to the twelfth word. Bingo. And there are two ways to get the answer. The first one is to pretend to be Microsoft’s Bing search robot. We do the same as in the tenth step in the Developer Tools settings, only we already set the User-Agent to Bing. Alternative – view a cached copy of the page in Bing.
Fine. One more word. And again on the way the unknown! What if you look to google cache?
There is still a little and only one question without clues. Let’s move on to the ld+json prompt. Such a piece of script can be seen in the head of the page.
<script type="application/ld+json">
{
"@context": "https://schema.org/",
"@type": "Clue"
}
</script>We try Clue – no effect. Then we open the validator on schema.org and…
We try interlinked and we succeed.
The fifteenth question is quite obvious. Removes the “s” in the address and get insecure protocol. As a result, again in the Network tab, we notice a couple of redirects, one of which will be the search word.
And the last push
The sixteenth again sends us to Google, as to a search engine. Searching the site by special request in the search engine.
I figured out the seventeenth question quickly enough, since the link was in a prominent place – right in the head of our file.
<link rel="canonical" href="https://hiddenkeyword.com">
There is very little left! 🗺 – what can this mean? Map… Sitemap…
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://hiddenkeywords.com/neutral</loc>
</url>
</urlset>And here is another link.
We pass to the penultimate task. 💡🏠 – charades again! Light… Home… Let’s try to make the home page and… Nothing! Again. If I had to pay a ruble for each idea, someone would have already become a millionaire. We must think further. Light… Home… House! Lighthouse! There is such a tab in Developer Tools. We launch the page on this tab and get what we were looking for.
The last step remains. 🎨 – palette. I will say right away, but this hint did not help me, I found it much earlier. I accidentally looked into the css file and everything became clear.
*! syndicate */
/*! normalize.css v3.0.2 | MIT License | git.io/normalize */
html {
font-family: sans-serif;
-ms-text-size-adjust: 100%;
-webkit-text-size-adjust: 100%
}
body {
margin: 0
}The very first word! Bingo!
Afterword
Not the most difficult test, nevertheless, the schedule made me sweat. I hope you manage to get through without these hints, but if not, you are always welcome. If it’s interesting, I’ll continue.
By the way, does anyone know of any other problems?
