Web-полигон (Web Polygon)

Platform: duckerz | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: http_method_enumeration, parameter_fuzzing

Summary

URL: http://tasks.duckerz.ru:30055

Web-полигон (Web Polygon) - duckerz CTF

Description

"Так все же Гетман или Постман?"

URL: http://tasks.duckerz.ru:30055

The task name is a wordplay: "Гетман" (GET-man) and "Постман" (POST-man) hint at HTTP methods GET and POST.

Analysis

Reconnaissance

When accessing the main page, the server indicates that the flag is split into 3 parts and provides hints on how to obtain each:

1. Part 1: GET request to /flag
2. Part 2: POST request to /flag
3. Part 3: GET request to /flag with any parameter ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The server runs on Werkzeug/3.1.3 Python/3.11.14 (Flask application).

Solution

Part 1 - GET request

 bash read-only • copy allowed Copy
curl -s http://tasks.duckerz.ru:30055/flag

Response:

 json read-only • copy allowed Copy
{"flagp1":"DUCKERZ{G3tReq_"}

Part 2 - POST request

 bash read-only • copy allowed Copy
curl -s -X POST http://tasks.duckerz.ru:30055/flag

Response:

 json read-only • copy allowed Copy
{"flagp2":"REDACTED"}

Part 3 - GET with parameter

 bash read-only • copy allowed Copy
curl -s "http://tasks.duckerz.ru:30055/flag?param=1"

Response:

 json read-only • copy allowed Copy
{"flagp3":"MIXXXXX!}"}

Assembling the flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Combining all three parts in the order they were obtained:

DUCKERZ{G3tReq_ + REDACTED + MIXXXXX!}

Automated Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# solve.sh - automatic flag retrieval

URL="http://tasks.duckerz.ru:30055/flag"

# Get all parts
p1=$(curl -s "$URL" | grep -oP '"flagp1":"\K[^"]+')
p2=$(curl -s -X POST "$URL" | grep -oP '"flagp2":"\K[^"]+')
p3=$(curl -s "$URL?x=1" | grep -oP '"flagp3":"\K[^"]+')

echo "Flag: ${p1}${p2}${p3}"

Lessons Learned

1. HTTP methods: Difference between GET and POST requests
2. Query parameters: How to pass parameters in URL (?key=value)
3. curl: Basic usage for HTTP requests
4. REST API: Understanding endpoints and methods ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Related Techniques

• HTTP Method Tampering
• Parameter Pollution
• REST API enumeration
• Verb Tampering (using non-standard HTTP methods)

Additional Notes

For more complex variations of this task, the following may be required:

• Other HTTP methods: PUT, DELETE, PATCH, OPTIONS
• Specific headers (Content-Type, Authorization)
• Request body in a specific format (JSON, XML, form-data)
• Combinations of methods and parameters ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍