Level 20

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: anticheat_bypass, http_basic_authentication, raw_http_crafting

Summary

Walkthrough of the CUSTOM Web Level 20. Task: Access a page protected by anticheat proxy that blocks standard HTTP clients. Solution: Send raw HTTP requests via netcat with Basic Authentication header, line by line with delays.

Description

The page at http://kslweb1.spb.ctf.su/second/level20 returns 403 Forbidden and redirects to an anticheat proxy on port 58080. The anticheat requires sending raw HTTP requests line by line via netcat with delays between lines (to prevent automated tools).

Analysis

Step 1: Initial Access

The anticheat proxy requires:

• Sending HTTP requests via netcat (raw TCP)
• Each request line sent separately with delays
• Using CRLF (\r\n) as line separators

Step 2: Discovering Requirements

Basic GET request via netcat:

GET /second/level20/ HTTP/1.1\r\n
Host: kslweb1.spb.ctf.su\r\n
Connection: close\r\n
\r\n

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Server response (200 OK):

Nope, you should send a Basic authentication with your request (how does basic auth work?)
Username: admin
Password: s3cr3tp4$$w0RD

Current username: none
Current password: none

Current HTTP headers: Array
(
    [Host] => kslweb1.spb.ctf.su
    [Connection] => close
)

Step 3: HTTP Basic Authentication

HTTP Basic Authentication works via the Authorization header with value Basic <base64(username:password)>.

Encoding credentials:

 bash read-only • copy allowed Copy
echo -n 'admin:s3cr3tp4$$w0RD' | base64
# YWRtaW46czNjcjN0cDQkJHcwUkQ=

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Sending GET request with Authorization header via netcat:

 bash read-only • copy allowed Copy
{
  printf 'GET /second/level20/ HTTP/1.1\r\n'; sleep 1
  printf 'Host: kslweb1.spb.ctf.su\r\n'; sleep 1
  printf 'Authorization: Basic YWRtaW46czNjcjN0cDQkJHcwUkQ=\r\n'; sleep 1
  printf 'Connection: close\r\n'; sleep 1
  printf '\r\n'
} | nc kslweb1.spb.ctf.su 58080

Response:

HTTP/1.1 200 OK
Content-Type: text/plain

Done! Flag: KSL{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering anticheat_bypass, http_basic_authentication, raw_http_crafting was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-08 • CUSTOM • Level 20 • Difficulty: Easy