Rating:
## [Original/Source Writeup](https://bigpick.github.io/TodayILearned/articles/2020-10/b01lersbootcamp#programs-only)
Navigating to the site, we see a page that displays our User-Agent string in the webpage, along with some other just random pages.
Searching around, nothing really sticks out. In the source code, we see the following HTML comment:
```html
```
Navigating to `/program`, we get:
```
Unauthorized.
Users do not have access to this resource.
```
Combining that with the home page displaying our User-agent, we probably need to modify our User-Agent to match some “Program” requirement.
Checking `robots.txt` (as you always should for low level web challenges), we see:
```
User-agent: *
Disallow: /
User-agent: Program
Allow: /program/
User-agent: Master Control Program 0000
Allow: /program/control
```
So we can hit those pages with the above User-Agents like so:
```
curl -H "User-agent: Program" http://chal.ctf.b01lers.com:3003/program
curl -H "User-agent: Master Control Program 0000" http://chal.ctf.b01lers.com:3003/program/control
```
The second ends up having our flag:
```html
<html>
<head>
<title>Master Control.</title>
<link
rel="stylesheet"
href="/static/css/tron.css"
/>
<link
rel="stylesheet"
href="/static/css/style.css"
/>
</head>
<body>
<div id="main-wrapper">
<div class="content-page">
<div>
<h1>Master Control.</h1>
</div>
<div>
flag{who_programmed_you?}
Flag is flag{who_programmed_you?}.
