GET aHEAD

Platform: PicoCTF Category: Web Exploitation Environment: Standalone

Goal: a page with two buttons, Red and Blue, and a flag that is nowhere in what either of them returns. The title is the hint.

Approach

Proxy the site through Burp Suite and click both buttons, then read the pair in Proxy under HTTP history. They are not the same request: one submits with GET and the other with POST. That is worth noticing, because it means the two controls differ in method rather than in content, and method is therefore the axis the challenge is played on.

It is not the answer, though. The page offers exactly two choices and the challenge hint says there are more than two, which puts the missing one outside the interface entirely. The title supplies it: GET aHEAD capitalises a third method, and HEAD is the one method every general-purpose server is required to implement alongside GET.

Send them to Repeater and change the method. Burp’s built-in Change request method toggles between GET and POST and offers nothing else, so HEAD goes into the request line by hand.

Repeater

HEAD /index.php HTTP/1.1

A HEAD response carries no body. That is the definition of the method rather than an implementation detail, so whatever the flag is, it cannot be in the page, and the response pane’s headers are the only place left to look. It is there, in a header named flag.

Flag picoCTF{r3j3ct_th3_du4l1ty_70bc61c4} Reveal

The eight hex characters before the closing brace belong to the deployed instance rather than to the challenge, and mercury.picoctf.net no longer resolves, so a reader following along launches their own and gets a different suffix.

Why it works

flag is not a registered HTTP field, and no stock server, cache or proxy invents one. It exists because the challenge’s own configuration puts it there, conditioned on the request method.

HEAD is meant to be GET without the body, and the specification asks a server to answer it with the same header fields it would have sent for a GET. This one does not, which is why the two requests the interface can send come back without the flag and the third finds it. The methods a route answers are a longer list than the controls that call it, and the list is short enough to try.