In this post I am covering the challenge “Baby Pass” from the BsidesMumbaiCTF competition. This challenge was under the web category.
For this challenge we are provided with a web instance “http://13.232.136.172:1337/"
And after loading up this page we get the following page:
Easy flag, yea? NO! Because after going to /flag endpoint we get a 403 forbidden error of nginx
Now after being completely foxed by this dead end, I started googling like a madman trying to figure out something to bypass this 403 error. I found something on reddit, which caught my eye (here: https://www.reddit.com/r/hacking/comments/105qkvc/any%5Ftips%5Ffor%5Fbypassing%5Fhttp%5F403%5Fforbidden%5Fpage/)
So basically what this response says is that using uppercase in the /flag endpoint would eventually bypass the 403 forbidden error. So now instead of trying /flag I tried /Flag and there I had the Flag!
