We are told that the page is only accessible via PicoBrowser. When making an HTTP request, the header field that defines which “browser” we are using is the User-Agent. So, I opened the site with BurpSuite and sent the request to the Repeater:
Repeater
From the repeater, I modified it by adding the suggested User-Agent: PicoBrowser, and I was able to move on to the next step:
User-Agent
As we can see, the message has changed. Now it tells us that it doesn’t trust users coming from another site. I think this challenge will be mainly about modifying and adding fields to the request header, so let’s proceed with the exploitation.
๐ฏ Solution Path
Exploitation Steps
Exploitation
After a few searches to bypass the second check, I found the Referer header. The HTTP Referer header contains the absolute or partial address from which a resource has been requested. By setting it as Referer: mercury.picoctf.net:36622, the server believes the request is coming from the server itself, allowing me to pass this check as well:
Referer
Now we are told that this site only worked in 2018. We can bypass this check by setting the Date field to 2018, i.e., Date: 2018:
Date
The next check is about tracking. After some searching, I found the DNT (Do Not Track) field, which specifies tracking preferences. By setting DNT: null, I was able to bypass this check:
DNT
Next, we are told that the website is only for people from Sweden. This check can be bypassed by setting X-Forwarded-For to an IP address from Sweden. I did some research and found this: https://lite.ip2location.com/sweden-ip-address-ranges. However, there are other methods. One that came to mind was finding a website with the .se top-level domain, which indicates a Swedish site. Then, using tools like dig, ping, nslookup, etc., I found the IP associated with the domain and used it in the request:
X-Forwarded-For
As the last check, we are told that we donโt speak Swedish. This can be bypassed by setting the Accept-Language: sv,... field, as sv specifies the Swedish language. By modifying the field and sending the request, I passed the final check and obtained the flag.
Flag capture
Manual Flag
๐ ๏ธ Exploitation Process
Approach
The automatic exploit replicates the request made manually, setting the headers shown in the image above using BurpSuite. Once the request is made, it extracts the flag from the response using a regex.
