← Back to HWJ CTF

INSPECTION CAN LEAD TO DECEPTION

Interact with web API using non-standard HTTP methods (OPTIONS, TRACE) and headers to retrieve 4 flag parts.

Tools Used

cURLHTTP MethodsHex DecoderPython

Overview

API health dashboard hints at interacting with non-standard HTTP methods to gather four hex-encoded flag segments.

Reconnaissance

Testing OPTIONS and TRACE requests on / reveals flag parts 3 & 4 along with header instructions for X-ADMIN.

Exploitation Strategy

- GET with X-ADMIN: goated_af -> Part 1 (68776a7b346c6c5)
- POST with X-ADMIN: goated -> Part 2 (f683131705f6d337468)
- OPTIONS -> Part 3 (3064735f3472335f316)
- TRACE -> Part 4 (d70307274346e747d)
Concatenate in order and hex decode to reveal ASCII flag.

Solution Code

python3 -c 'print(bytes.fromhex("68776a7b346c6c5f683131705f6d3374683064735f3472335f316m70307274346e747d").decode())'
# Output: hwj{4ll_h11p_m3th0ds_4r3_1mp0rt4nt}

Flag

hwj{4ll_h11p_m3th0ds_4r3_1mp0rt4nt}