Commentary

Platform: scarlet | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: default_page_disclosure, host_header_manipulation, virtual_host_enumeration

Summary

Task: find a hidden flag on an nginx web server. Solution: send an HTTP request to port 80 with the task name "commentary" as the Host header, triggering the nginx default page which contains the flag in HTML comments.

Commentary - Scarlet CTF

Description

"You're currently speaking to my favorite host right now (ctf.rusec.club), but who's to say you even had to speak with one?" "Sometimes, the treasure to be found is just bloat that people forgot to remove."

Analysis

The challenge description contains several key hints:

1. "favorite host" - Points to Host header manipulation
2. "who's to say you even had to speak with one" - Suggests using a simple word instead of a full domain
3. "Commentary" (task name) - This IS the Host header value to use!
4. "bloat that people forgot to remove" - HTML comments in the response ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The challenge exploits nginx virtual host behavior:

• When nginx receives a request with an unknown Host header, it returns the default server's page
• The default nginx page was modified to contain the flag in HTML comments
• The key insight was that HTTP (port 80) behaves differently than HTTPS - it doesn't redirect when Host header doesn't match

Solution

Failed Attempts

1. Checked HTTPS with various Host headers (ctf.rusec.club, localhost, admin.ctf.rusec.club, etc.)
2. Checked SSL certificate for alternative names (found wildcard *.ctf.rusec.club)
3. Tried HTTP/1.0 requests without Host header
4. Checked robots.txt, source maps, JS files
5. Tried various HTTP methods (OPTIONS, TRACE, COMMENT) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Successful Approach

The crucial realization was:

1. The task name "Commentary" was literally the Host header value
2. HTTP (port 80) behaves differently than HTTPS
3. nginx returns its default page for unknown virtual hosts

Exploit

 bash read-only • copy allowed Copy
curl -s -H "Host: commentary" http://ctf.rusec.club/

Response

 html read-only • copy allowed Copy
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
...
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
...
<!-- you found me :3 --!>
<!-- RUSEC{REDACTED} --!>
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

Technical Details

Lessons Learned

1. Task name matters - The challenge name itself can be a crucial hint
2. Try HTTP, not just HTTPS - Different protocols may have different configurations
3. nginx default behavior - Unknown Host headers return the default server page
4. HTML comments - Always check page source for hidden content
5. Read hints carefully - "Commentary" + "comments" = HTML comments in response ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍