Clicking on the Flag button gives me an error message:
Error
you are not picobrowser and then the User-Agent header field from the request I made is printed. From here, one should already understand the resolution of this challenge.
🎯 Solution Path
Exploitation Steps
Initial setup
First, I intercepted the request with Caido:
Request
And as we can see in the User-Agent header field, it contains the same User-Agent seen in the 🔍 Initial Analysis section. Let’s proceed with the exploitation.
Exploitation
The User-Agent field is designed to identify the user agent responsible for sending a specific HTTP request. So, we can simply replace it directly with Caido, making it User-Agent: picobrowser. After forwarding the request, I obtained the flag in the response.
Flag capture
Manual Flag
🛠️ Exploitation Process
Approach
The exploit sends a simple GET request to /flag with the User-Agent: picobrowser header, then extracts the flag from the response using a regex.
