Gherkin template: hack

## Version 2.0
## language: en

#Keep comments if they start with double sharp ##

#M: Mandatory
#O: Optional

#{} are template tags. A final feature should not contain any of these.

Feature: {code}-{category}-{site} #M
  """
  This section is intended for the hacker
  to provide general information about the challenge he is trying to solve,
  what his goal is and the location of the challenge.
  """
  Code: #O
    {code} #Code of the challenge if it exists
  Site: #M
    {site} #Site where the challenge can be found
  Category: #O
    {category} #Category of the challenge within the site e.g: decoding, BoF...
  User: #M
    {user} #Username used in the site when solving the challenge
  Goal: #M
    {goal} #Short description of your goal

  Background:
  """
  In this section the hacker has to provide a list containing
  versions and names of the software
  he used for capturing the flag (OS, Browser, etc).
  Also, information about the machine where the challenge takes place like:
  Relevant services with their versions,
  OS and kernel with their versions, etc
  has to be provided
  """
  Hacker's software:
    | <Software name> | <Version>   |
    | {os}            | {version 1} |
    | {browser}       | {version 2} |
    | {name1}         | {version 3} |
  Machine information:
    Given I am accessing the {machine} through a VPN
    And SSH with {command}
    And enter a console that allows me to {A}
    And the server is running MySQL version {B}
    And PHP version {C}
    And SSH version {D}
    And is running on Ubuntu {E} with kernel {F}

  Scenario: {Fail|Success}:{metohd-used-1}
  """
  Scenarios allow the hacker to describe
  in a time-based order what he tried to solve the challenge.

  {Fail|Success}: Success if the flag was caught and Fail if it wasn't
  {method-used-*}: Brief description of what is done in the scenario

  Every shell command inside a docstring block must be prefixed with
  "$ ". Lines without "$ " are treated as tool output, not commands.
  This applies to every command in every scenario, with no exceptions
  — including short commands like echo, cp, cat, id, etc.

  When tool output inside a docstring would reveal the flag value,
  replace the literal flag with an accepted censored placeholder.
  Accepted forms: HTB{FLAG}, <flag>, [FLAG], HTB{xxxxxxxx}, <HIDDEN_FLAG>.
  Never write the real flag string anywhere in the .feature file.
  Example:
    $ cat flag.txt
    HTB{FLAG}
  """
    Given I am logged in the machine
    And I print {A}
    """
    $ {tool} {arguments}
    {tool output line 1}
    {tool output line 2}
    """
    Then I can see {B}
    Then I try to decrypt {B} by doing {C}
    """
    $ {tool} {arguments}
    {error or relevant output}
    """
    And get {D}
    Then I conclude that I can't use {D} for my purpose
    And {C} did not work
    And I could not capture the flag

  Scenario: {Fail|Success}:{method-used-2}
    Given I print {A}
    """
    $ {tool} {arguments}
    {tool output line 1}
    {tool output line 2}
    """
    Then I can see {B}
    Then I try to decrypt {B} by doing {E}
    And get {F}
    Then I can actually read the flag from {F}
    """
    $ {command-that-reveals-flag}
    HTB{FLAG} #{censored placeholder — never the real flag value}
    """
    And I conclude that {E} worked
    And solved the challenge
    And I caught the flag