Tags: api
Rating:
This is api challenge with no vulnerablity. May be the purpose of this challenge is to understand the code.
Challenge description--
Challenge url--
--Solution--
1# Create user using post request to "/api/user/new-token" by adding header "Authorization: 0nlyL33tHax0rsAll0w3d"('0nlyL33tHax0rsAll0w3d' is in config.py')
2# Post request to "/api/user/nothing-here" with "Authorization: (Your user token)". Your will See '{"detail": "requests were the same :rooFrozen:"}'
3# Add one random header(such as 'X-Forward-For: 127.0.0.1') and request again "/api/user/nothing-here"
4# If you see '{"detail": "i'm being hacked :rooNobooli: :banhammer:"}', that mean you get 100 points. You can check by going to "/api/user/points"
5# Repeat doing this(3#) until you get 1000 points.
6# When you get 1000 points, go to "/api/admin/flag" and enjoy your flag. :)
Flag: ictf{b3aT_tH3_g@Me_???}
Thank you for reading. :cowboy_hat_face: :cowboy_hat_face:
