NNS Travel web challenge - NNS CTF 2026

NNS CTF — NNS Travel web challenge

category : easy

The UI of the challenge looks like this- The green coloured seats(available and the black ones are not). The challenge wants you to nudge the premium/ unavailable seat numbers to obtain the flag - 3B,C,D and 4A,CD,D.

when you look at the js code, you will see:

saveBtn.addEventListener('click', async () => { const res = await fetch('/save', { method: 'POST', body: JSON.stringify({ seat: selectedSeat , }), }); const d = await res.json();

if (!d.ok) { alert(d.error); } else { saveBtn.disabled = true; if (d.flag) { location.reload(); }}});

1. the HTTP POST request is going only when /save function is triggered. The fetch call has no independent check like "is this seat actually allowed to be saved?" before loading it.

2. JSON.stringify({ seat: selectedSeat }) is the payload the server expects- i.e the seat numbers you are "not supposed to acess".

3. await res.json() parses the payload into d. if d.flag is true, the page reloads and returns you the flag.

4. the saveBtn.disabled= true is only visible to client side. No server side validation is happening.

As my first instinct, i hit the cURL command:

curl -X POST https://TARGET_HOST/save
-H "Content-Type: application/json"
-d '{"seat":"3B (or any permium seat)"}'

and it returns the flag.

Points to remember as a developer : you are not supposed to trust any client. Informations about seats/ premium seat should be generated and looked up from database itself- if a client is supposed to book a premium seat, should be granted from the user's account information stored in the database.

The request headers should use 'content-type: application/json' to prevent csrf or xss or any client side attacks. An user should be authenticated to access what they are accessing before server grants them authorisation.