picobrowser (Medium)
- Challenge Link: https://play.picoctf.org/practice/challenge/9?category=1&difficulty=2&page=4
- Challenge Description: This website can be rendered only by picobrowser, go and catch the flag!
- Hints:
- You don't need to download a new web browser
Solution
In this challenge, we get to learn why User-Agent headers matter and how servers can behave differently based on request metadata. As you can see on the front page, we can't see the flag because we are not using the trusted browser it wants us to use, which is picobrowser.
We could try using wget to try and download the file, but using the normal wget does not work because it still does not trust us since it uses a default header and not a picobrowser header. So we must modify the User-Agent header. A User-Agent header basically tells the server what browser you’re using and what device/OS you’re on.
wget http://fickle-tempest.picoctf.net:64238/flag -U picobrowser
After saving the file, we can read it to find our flag.
vi flag
picoCTF{p1c0_s3cr3t_ag3nt_fba5c48f}
