Overview
API health dashboard hints at interacting with non-standard HTTP methods to gather four hex-encoded flag segments.
Reconnaissance
Testing OPTIONS and TRACE requests on / reveals flag parts 3 & 4 along with header instructions for X-ADMIN.
Exploitation Strategy
- GET with X-ADMIN: goated_af -> Part 1 (68776a7b346c6c5)
- POST with X-ADMIN: goated -> Part 2 (f683131705f6d337468)
- OPTIONS -> Part 3 (3064735f3472335f316)
- TRACE -> Part 4 (d70307274346e747d)
Concatenate in order and hex decode to reveal ASCII flag.
Solution Code
python3 -c 'print(bytes.fromhex("68776a7b346c6c5f683131705f6d3374683064735f3472335f316m70307274346e747d").decode())'
# Output: hwj{4ll_h11p_m3th0ds_4r3_1mp0rt4nt}Flag
hwj{4ll_h11p_m3th0ds_4r3_1mp0rt4nt}