Level 18 - URL Encoding POST Data

Platform: kslweb1 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-08 | Status: Solved Techniques: raw_http_post, tcp_timing_bypass, url_encoding

Summary

Task: Send POST data with ampersand character in field value. Solution: URL-encode the ampersand as %26 and bypass anticheat proxy by sending HTTP request line by line with delays.

Level 18 - URL Encoding POST Data — kslweb1

Description

A task about understanding URL encoding in POST data. You need to send a POST request with a field containing the & character, which is a field separator in the application/x-www-form-urlencoded format. Additionally, you need to bypass the anticheat proxy by sending the request line by line with delays.

Analysis

Anticheat Proxy

As in level16, the main URL on port 80 returns 403 Forbidden and redirects to the anticheat proxy on port 58080. The proxy detects automated tools by checking whether the HTTP request is sent all at once (tool) or line by line with delays (human). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Task Requirement

The GET request returns a hint:

!!!!!!######Nope, you should send one POST field 'makers' with words 'Kaspersky & SPBCTF' (how post values are encoded?)
Current HTTP method: GET
Current POST fields: array(0) {}

Key Insight

In the application/x-www-form-urlencoded format:

• The & character is a separator between fields (field1=value1&field2=value2)
• To include a literal & in a field value, it must be encoded as %26
• Spaces are encoded as + or %20

Therefore, Kaspersky & SPBCTF is encoded as Kaspersky+%26+SPBCTF. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Reconnaissance via GET Request

 bash read-only • copy allowed Copy
(echo -ne "GET /second/level18/ HTTP/1.1\r\n"; sleep 1; \
 echo -ne "Host: kslweb1.spb.ctf.su\r\n"; sleep 1; \
 echo -ne "Connection: close\r\n"; sleep 1; \
 echo -ne "\r\n") | nc kslweb1.spb.ctf.su 58080

Step 2: Sending POST Request with Proper Encoding

POST body: makers=Kaspersky+%26+SPBCTF (27 bytes)

 bash read-only • copy allowed Copy
(echo -ne "POST /second/level18/ HTTP/1.1\r\n"; sleep 1; \
 echo -ne "Host: kslweb1.spb.ctf.su\r\n"; sleep 1; \
 echo -ne "Content-Type: application/x-www-form-urlencoded\r\n"; sleep 1; \
 echo -ne "Content-Length: 27\r\n"; sleep 1; \
 echo -ne "Connection: close\r\n"; sleep 1; \
 echo -ne "\r\n"; sleep 1; \
 echo -ne "makers=Kaspersky+%26+SPBCTF") | nc kslweb1.spb.ctf.su 58080

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Server response: Done! Flag: KSL{REDACTED}

Pitfalls

1. Missing trailing slash: Request to /second/level18 without / returns a 301 redirect
2. Extra newline in body: \r\n after the POST body adds a newline to the field value, causing rejection
3. Exact Content-Length: Must be exactly 27 bytes, no extra characters ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍