HTTP/3 is just the best version of HTTP, wait a few years, until setting up an HTTP/3 server will not be a pain, and you’ll see. I hid a secret on /flag, you can only get it if you become a real HTTP/3 enjoyer. NOTE: This challenge uses only HTTP/3, browsers are a bit hesitant in using it by default, so you’ll have to use explicit arguments to do so. In chrome you can do the following:
chrome –enable-quic –origin-to-force-quic-on=enjoyer.challs.ctf.srdnlen.it
Receiving a response with a 403 Unauthorized error:
Forbidden
Then I noticed that this was being blocked through the server’s proxy rules:
1
2
acl restricted_flag path_sub,url_dec -m sub -i i /flag
http-request deny if restricted_flag
Through an HAProxy proxy. So I started doing some research online to find an effective bypass for this proxy rule.
🔬 Vulnerability Analysis
Potential Vulnerabilities
403 Bypass
Proxy Rule Bypass
🎯 Solution Path
Exploitation Steps
Initial setup
After searching online, as mentioned earlier, I found the page on StackOvreflow, from which I figured out how to craft the exploit. The trick was to URL-encode the slash (/) in a special syntax, but I also tried using the --path-as-is option in curl, but it didn’t work. After that, I needed to craft any header to bypass the rule.
Exploitation
With the following exploit, I was able to obtain the flag:
I wasn’t able to write the automatic exploit in Python due to issues with HTTP/3. I also tried using httpx, but it didn’t work. I even attempted using bash script, but without success.
Automated FlagScreenshot of successful exploitation
🔧 Tools Used
Tool
Purpose
Curl
Http3 request
💡 Key Learnings
New Knowledge
I learned about HTTP Request Smuggling and Header Smuggling from this challenge, but in the end, it was a bypass of the proxy rules through encoding with the addition of a crafted header field.
