Czechstreets 139 __link__ Official
Event: CzechStreets CTF (2024) Category: Web / Information‑Disclosure / Minor Crypto Difficulty: ★★☆☆☆ (easy–medium) 1️⃣ Challenge Overview | Item | Description | |------|-------------| | Title | czechstreets – 139 | | Provided | A public URL: http://139.czechstreets.ctf (the “139” sub‑domain is part of the challenge name). The landing page shows a simple map of Prague with numbered streets and a tiny search box that says “Find the hidden street”. | | Goal | Retrieve the flag, which is hidden somewhere on the site. | | Flag format | czechstreets… |
GET /api/streets?offset=138&limit=1000000 Running the request:
curl -s "http://139.czechstreets.ctf/api/streets?offset=138&limit=1000000" | jq . Result: czechstreets 139
<form method="GET" action="/search"> <input type="text" name="q" placeholder="Street name…" /> <input type="submit" value="Search" /> </form>
<!DOCTYPE html> <html> <head><title>Czech Streets – Find the hidden street</title></head> <body> <h1>Welcome to the Czech Streets challenge!</h1> <p>Enter a street name to see its details.</p> | | Flag format | czechstreets… | GET /api/streets
"flag":"czechstreets flag_really_email_html " The flag is clearly embedded in the JSON. A one‑liner to fetch and decode in one go:
In short: that lets us read arbitrary street objects, including the hidden one with id = 139 . 4️⃣ Exploiting the Bug 4.1 Crafting the request We want the object with id = 139 . The API returns records in order of id . By setting offset=138 and a huge limit we can retrieve the 139th entry: 4️⃣ Exploiting the Bug 4
curl -s "http://139.czechstreets.ctf/api/streets?offset=138&limit=1000000" \ | jq -r '.[0].metadata' \ | base64 -d \ | jq -r .flag Output: