PicoCTF - Who are you?
22 Sep 2022picoCTF Challenge
Tags
PicoCTF 2021 / Web Exploitation
Description
Let me in. Let me iiiiiiinnnnnnnnnnnnnnnnnnnn
http://mercury.picoctf.net:52362/
Writeup
Note that everyone ‘s port and flag are different!
- Visit this site, it says: Only people who use the official PicoBrowser are allowed on this site! So I use ThunderClient to request website and change
User-Agentin the header toPicoBrowser. - It says: I don’t trust users visiting from another site. So we can add the key of
Refererwith the valuehttp://mercury.picoctf.net:52362/to the header and request website again. - It says: Sorry, this site only worked in 2018. So we can add the key of
Datewith the value1 Jan 2018to the header and request website again. - It says: I don’t trust users who can be tracked. So we can add the key of
DNTwhich means do not track with the value1to the header and request website again. - It says: This website is only for people from Sweden. So we can add the key of X-Forwarded-For, which can change the originating IP, with the value random Sweden IP address to the header and request website again.
- It says: You’re in Sweden but you don’t speak Swedish? So we can add the key of
Accept-Languagewith the value sv to the header and request website again. Then we can get the flag! ٩(^ᴗ^)۶
- Header should be like :
