October 28, 2026
INE Introduction to Web Application Security Testing CTF 1
This is a simple walkthrough to solve the INE CTF about HTTP requests and responses.
By Marcio
2 min read
- 1 Task 1: Find the well-known reconnaissance file exposed at the web root.
- 2 Task 2: Discover hidden directories on the server through brute-forcing.
- 3 Task 3: Authenticate to the application and inspect the HTTP response.
- 4 Task 4: Identify the HTTP methods supported by the internal API.
- 5 Task 5: Exploit the admin search feature to reveal a hidden record.
Task 1: Find the well-known reconnaissance file exposed at the web root.
The lab offers a tip, the flag is hidden on a "well-known file at the root level that reveals directories and paths the site owner considers sensitive or restricted", in other words, robots.txt. Lets check:
The tip on the lab says that the file containing the flag is named ".flag1.txt", following the logical path, we can find it without too much effort:
Task 2: Discover hidden directories on the server through brute-forcing.
You don't even need to think twice, just use dirb and brute force the directories!
So, there are some interesting things here, but for now lets keep the focus on the backup directory:
Now we just need to download and see what we have, I used 'cat', but you may open the file using whatever you want:
Here we have flag2 and another useful information to find the next flag.
Task 3: Authenticate to the application and inspect the HTTP response.
To inspect the HTTP request and response we may use Burp Suit or Zap Proxy, this time I'll show how Burp Suit can help us with this task.
Using FoxyProxy to enable interception on Burp Suit, it's just to sign in and Forward the requisitions, then, check the responses on HTTP History:
Task 4: Identify the HTTP methods supported by the internal API.
To discover the methods suported, let's follow to the API page (remember we found it when brute forced the hidden directories?), send the request to Repeater and use OPTIONS method to see how can we find the next flag:
As the image show, the flag is not here, but the hint says that some methods "should never be enabled in production"… Get it. So let's use the most dangerous one: DELETE!
Task 5: Exploit the admin search feature to reveal a hidden record.
To find the last one we need to interact the search feature at admin panel, but "no regular search will ever return, unless you change what the query actually does." So it look like SQLi, right? We just need to use the most classical payload to test injection: ' OR '1'='1
Really enjoyable to learn practicing with INE CTF's, hope this tutorial help you learn and enjoy it too.