> For the complete documentation index, see [llms.txt](https://ad3n.gitbook.io/ad3n/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ad3n.gitbook.io/ad3n/home/ctf-writeups/texsaw-ctf-2024/web.md).

# Web

* ## Ask, and It Shall Be Given to You

  <figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FvykSHy1mpXQU9Y4n5dMJ%2Fimage.png?alt=media&amp;token=240b2984-627f-4f79-9494-da6241242354" alt=""><figcaption></figcaption></figure>

Visiting the web page result in `Website down! please contact IT for more information` and at this point try to go into `robots.txt` will result in 2 disallow directory that need to look for.

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FycjSh4TMrQfx5uNvNY4X%2Fimage.png?alt=media&amp;token=1a48da7f-d20b-4923-b1a9-e82dfde371c7" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FDdYsK5i0kMGy1GieANLH%2Fimage.png?alt=media&amp;token=04abe10d-a3ad-4ce7-ab63-656512789287" alt="" width="563"><figcaption></figcaption></figure>

I mainly focusing on `/contactIT` directory because there nothing interesting in `/countdown`. Upon going to the `/contactIT` directory show that it only accept `Post:Json Request Only`. So, open the burp suite and change the http method result in unsupported media type which need to add `Content-Type: application/json` into http request header.

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2F2zkpqiOvDBnE34qGVhch%2Fimage.png?alt=media&amp;token=fea195c8-cb01-49fc-ab38-9e826f526227" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FZQPQ7XZTgrQDYlhR0YN5%2Fimage.png?alt=media&amp;token=5f4f31fc-4783-4974-a784-b45d3bb50f28" alt="" width="563"><figcaption></figcaption></figure>

Doing so will give another error, failed to decode json object. But this time when I try to place the curly bracket in http request header it responds in traceback errors python and display what line that produce these two error that look interesting , `f.checkResponds(messege)` and also `if "flag" in responds:`.

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FeWQ3tUGczLjV5FsuHLvw%2Fimage.png?alt=media&amp;token=23481a76-853f-4ab7-a010-43ead67602e7" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FBjEKdLLuwneBfUQFQ6sy%2Fimage.png?alt=media&amp;token=f4d4a80c-b776-4da3-a08e-eb0a557b2be7" alt="" width="563"><figcaption></figcaption></figure>

Basically what it need is two object which is email (valid email) and also messege in json format. To retrieve the flag, it check weather in messege has request "flag" then it will send the true flag to the email that has been entered. Finally, doing so will give the flag send through email that provided before.

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FY9qPxwOeJvvJa2S0i4oO%2Fimage.png?alt=media&amp;token=d78e3f2f-dd4e-458c-900e-81e3ee420066" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2Fln6WBjrFcaIZoE33Hx62%2Fimage.png?alt=media&amp;token=5deee5e1-6bb5-408d-a513-fa188c0b3048" alt="" width="563"><figcaption></figcaption></figure>

Flag: `texsaw{7h15_15_7h3_r34l_fl46_c0n6r47ul4710n5}`