HTB Cyber Apocalypse 2026: Gatery (Web) Writeup

I played this international CTF with my team EWU_ROOTX where we achieved 164th rank.

Well,lets talk about how I hacked into the system and discovered the flag??

Honestly,the challenge included the application source code and I deem it was entirely a mix of both SAST and DAST skills.So,I went through all the source files and I saw api endpoints were entirely disclosed like api/flag was totally exposed and it was an existing one when I manually approached this endpoint and I saw it was checking something.

Interestingly,in source codes,I saw this endpoint was expecting one cookie:

Cookie: session=inside

This indicated that the application relied on a simple session value rather than a signed token or server-managed session.

At first,I sent a get request to api/flag but this time,I sent a POST request:

Well,you can see the format in the screenshot!

POST /api/flag HTTP/1.1

Host:

Cookie: session=inside

Content-Type: application/json

The route returned the flag when accessed with the expected session cookie.

Response by Server:

The server responded successfully:

{

"ok": true,

"flag": "<REDACTED_FLAG>"

}

This confirmed that the endpoint was directly accessible once the expected session cookie was supplied.

Well,the application exposed a sensitive endpoint (POST /api/flag) without enforcing proper authorization and as the required session value (session=inside) was discoverable from the provided source code, anyone reviewing the code could reproduce the request and obtain the flag.

So,at the end I was very happy to contribute in this CTF to our team EWUCSC_ROOTX.

Hats off Team EWUCSC_ROOTX