ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Tracks / Web Cache Poisoning / Hit or Miss

Hit or Miss

Hard 40 pts

A photo-sharing site caches image responses per URL. Whether a given private album cover is already cached leaks whether someone recently viewed it — a fast HIT means yes, a slow MISS means no. The log below probes a set of album ids; exactly one is warm. That warm id points to the album whose cover embeds the flag.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

Read the timings. Five requests, four slow, one fast — the fast one was already in the cache.

Hint 2

'Already cached' means someone viewed it recently. That is the album of interest.

Hint 3

The flag is the token attached to the cover of the album that returned a fast HIT.

The artifact

GET /cover/album-8801   304  MISS   198 ms
GET /cover/album-8802   304  MISS   211 ms
GET /cover/album-8803   200  HIT      6 ms   X-Cache: HIT  Age: 41
GET /cover/album-8804   304  MISS   205 ms
GET /cover/album-8805   304  MISS   187 ms

--- album-8803 metadata (fetched via the warm cover) ---
{"album":"8803","owner":"privé","caption":"nm{a_hit_is_a_leak}"}

Only 8803 was warm — because someone had just looked at it. The timing told you which.

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.