Rating:
The web page asked me to guess the flag. If I click Guess the flag
button with input this_is_the_flag?
will send POST data that look like this:
{"this_is_the_flag?":true}
This is weird. Why the input is a JSON key instead value? So the server must use the flag as a JSON key
Let see what if I send empty data maybe the server will show some error message.
curl "http://34.84.69.72:34705/" -X POST
{"statusCode":500,"error":"Internal Server Error","message":"Cannot read property 'TSGCTF{M4king_We6_ch4l1en9e_i5_1ik3_playing_Jenga}' of null"}
I got the flag!