This is one of my writeups for PicoCTF 2018
There is a website running at http://2018shell3.picoctf.com:44730 . Try to see if you can push their buttons.
- What's different about the two buttons?
If we browse to a website, we are presented with the following form :
<form action="button1.php" method="POST"> <input type="submit" value="PUSH ME! I am your only hope!"/> </form>
Clicking the button takes us to a second page than has another button - this time a link :
If we click the second button, we are shown an error :
<form action="button2.php" method="POST"> FORM DISABLED. THIS INCIDENT HAS BEEN LOGGED AND REPORTED TO /dev/null </form>
Now the hint was to look at the difference between the two buttons.
- The first button was form pointing to
- The second button was a link, meaning clicking it send a
- In the error page there is a form that points to
This seems to indicate that we should try sending a
POST requests to
button2.php (I used Burp Suite's proxy and
repeater for tha). And indeed when we do, we are given the flag :