So, true story: Once upon a time I wrote a short little MMO tie-in ARG. Like, not officially. Just for fun. The game was the then-Secret World, currently Secret World Legends, and I posted the initial link to the forums and it was… received pretty well? I think. Anyway, people definitely had a go at it, and they definitely thought they finished it.
Here’s the thing: no-one ever finished it. I know, because the last step sends me an email when someone completes it. I have never gotten an email.1
The other day, after a long, long hiatus, I picked up SWL again and… discovered I didn’t hate it as much as I’d initially thought? Which made me kinda nostalgic for my old ARG. And, well. Made me figure it’s probably about time I wrote a walkthrough. So here we go!
shockbox.net just displays some vaguely weird text in blue3 monospaced font on a black background.
Highlight the page text.
The text is also a link. Click it to be redirected to a password-locked Tumblr.
You’ll notice that there is one part of the highlighted text above that’s both, a) hidden, and b) not in binary:
Z2FpYWNyaWVz.4 Could this possibly be the Tumblr password?
This goes to a single Dropbox download link, to a password-protected 7-Zip file called
The password to this file is
Inside the file is a PDF of a (faked) academic paper, and the tl;dr is to scroll down to the bottom of the PDF file, to the references section.
Oh no it’s a link to another locked Tumblr…
The name of this Tumblr,
kingsmouth-409-308, is our next clue. Could this mean we need to… open up the game and go to the coordinates x:409 y:308 in Kingsmouth town?
Unfortunately, versions of “Susie’s” or “diner” aren’t our password. So is there something else associated with this place we could use?
A bunch of phonebooks are scattered around Kingsmouth, for use in some of the quests. If we check one, we’ll notice the phone number for Susie’s is listed as
555-1362. Turns out, this is our password.
Now we get to watch a creepy-ass video.5
The tl;dr for this one is that it’s a book cipher. The heading (0:11 0:58 0:27) reference timestamps in the video. The words at the listed timestamps turn out to be the words
filth zero beneath. But… where do we use them?
Hey… you remember that Twitter account?
The URL in the bio leads to a blank page with a password input. Input
filth zero beneath (with or without spaces; it should work either way) to get to…
Here is where you might be starting to get the impression I initially wrote this with the intention of it being the first part of a longer chain. Except… no one ever actually got to the end of this part, so… I never wrote any more. Bummer, I guess. But, whatever. Where to next?
Literally just increment the URL.
On this page, we get three photos: one of New York, one of London, and one of Seoul. And this is also where, I think, people got fucked around. Because they “solved” the puzzle from the point-of-view of their character’s in-game faction, rather than taking the GIANT BLUE EYE HINTS from the ARG’s flavor text.6
In TSW/SWL, “blue” and “eyes” mean Illuminati, and the Illuminati come from New York. So we have to do something with the New York photo. Originally, I wanted to make this a steganography puzzle, but thought that was a little too mean. So instead, just check the filename of the New York image to find that it’s
Oh, and as a hint: you must have cookies enabled from this step forward to progress.
We’ve got more weird numbers down the bottom, which is another book cipher; line number then word within that line. This one is a bit of a pain: the key text is the lyrics for the song, as written out on AZLyrics (the top Google hit when I was making this), but with all extraneous line breaks and non-lyric information removed. The end result says
back to the start.
So… back to shockbox.net. Except… nothing’s changed?
This one I actually had to give out a hint for, which you can see here. Honestly, I thought this step would’ve been a lot easier than it turned out to be, but apparently that’s because I’ve been to too many, like, Hacking 101 SANS courses or something. Anyway,
⌘+⌥+I is the shortcut to bring up the developer console in Chrome on macOS.8
If you look at the source, you’ll notice a hidden
div has appeared containing a form field. Note you have to have the cookie set from the previous step for this to show up, so if you’re not seeing it, that’s why.
There are a bunch of ways to deal with a hidden input field, but the easiest is just to straight-up delete the
style="display:none;" in the HTML shown in the dev console.9
So now we have our final form field. Since we’ve just spent many excellent minutes listening to Peter Gabriel, the answer to this final puzzle should be easy (
And that’s it; you’re done!
To celebrate, you’ll be given a Special Code (ref. previous comments re. thoughts that I’d expand this little game), and I’ll get sent an email telling me you made it to the end.
So… yeah. My Baby’s First ARG. And now you know.
- I mean, that wasn’t from me. So I know the thing works. [↩]
- Did I register a domain solely for the purpose of this dumb game? Of course not! Did I re-purpose a domain I already owned and the only reason I’ve been holding onto it all these years is because of this? Uh… [↩]
- Remember this for later… [↩]
- For the record, the binary translates as
taste and see. The password is Base64-encoded and translates as
- For the record, this is me filming one of the fountains on the Tokyo map with my phone held up to the computer monitor, with the Windows text-to-speech app reading out a text file in the background. I did the whole thing on my phone. It’s literally the most complex “video production” I’ve ever done. [↩]
- Again, the idea was that “future versions” would introduce paths for all three factions but, again… that didn’t happen, obviously. [↩]
- And, yes. If you do the same thing for the photos of London and Seoul, you’ll get different videos. I think the first person who publicly solved this ARG was a Templar, so… you can see where some of the confusion is coming from, yeah? [↩]
- Or, again… was at the time of writing. I actually don’t use Chrome any more so I’m not sure if it’s the case. [↩]
- Yes, in case you weren’t aware, this is A Thing You Can Do. Yes, you can use it to make arbitrary changes to the displayed content of any website. How do you think people fake up realistic-looking screenshots of things on, like, Twitter or whatever? [↩]