GETman и POSTman

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: combined_get_post_request, json_type_matching

Summary

Walkthrough of the CUSTOM Web GETman и POSTman. Task: a uvicorn-served web endpoint required a specific GET parameter together with POST data to return the flag. Solution: send a POST request with want_flag=YES in the query string and a JSON body w

Overview

Таск на понимание GET и POST запросов и манипуляции с ними

Target: http://62.173.140.174:16002/

This challenge was about building one request that satisfied both GET and POST checks. The important detail was that the backend also enforced the expected POST data type for admin.

Reconnaissance

• GET / returned 200 OK from uvicorn.
• The response explained the flag conditions directly: send want_flag=YES as a GET parameter and admin=1, message=Hello as POST parameters.
• OPTIONS / returned 405 Method Not Allowed with Allow: POST, confirming that the working request had to use POST.
• robots.txt, /.git/HEAD, and /.env all returned 404, so there was no extra path or file disclosure involved. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Exploitation

The first attempt used a query string plus URL-encoded form data:

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:16002/?want_flag=YES" -d "admin=1&message=Hello"

That returned 500 Internal Server Error, so plain form encoding was not accepted by the backend.

The second attempt used JSON, but sent admin as a string:

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:16002/?want_flag=YES" -H "Content-Type: application/json" -d '{"admin":"1","message":"Hello"}'

This time the server reflected both the GET and POST parameters, proving the request format was closer to correct, but it still did not return the flag. The reason was the type mismatch: "1" was a JSON string, not a numeric value. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The successful request used JSON with numeric admin: 1:

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:16002/?want_flag=YES" -H "Content-Type: application/json" -d '{"admin":1,"message":"Hello"}'

That satisfied all server-side checks and returned the flag.

Key Lesson

Mixing GET and POST in one request was only part of the puzzle. The decisive detail was matching the backend's expected POST body format and types: JSON was required, and admin had to be the numeric value 1, not the string "1". ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering combined_get_post_request, json_type_matching was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-04 • CUSTOM • GETman и POSTman • Difficulty: Easy