Czechstreets 139 -
GET /api/streets?offset=138&limit=1000000 Running the request:
The challenge looks innocuous – a tiny web‑app that lets you query street names. The trick is that the back‑end leaks data via an undocumented API and the flag is encoded in the metadata of a particular street entry (street #139). 2.1 Browsing the site $ curl -s http://139.czechstreets.ctf Result (truncated): czechstreets 139
<!DOCTYPE html> <html> <head><title>Czech Streets – Find the hidden street</title></head> <body> <h1>Welcome to the Czech Streets challenge!</h1> <p>Enter a street name to see its details.</p> GET /api/streets
"flag":"czechstreets flag_really_email_html " The flag is clearly embedded in the JSON. A one‑liner to fetch and decode in one go: A one‑liner to fetch and decode in one
curl -s "http://139.czechstreets.ctf/api/streets?offset=138&limit=1000000" | jq . Result:
[ "id":1, "name":"Hradčanské náměstí", "slug":"hradcanske-namesti", "id":2, "name":"Národní", "slug":"narodni", … ] Only the first 50 streets were returned (pagination). The id field is a simple integer that matches the street number on the map. The API supports the following query parameters (found by reading app.js ):
Event: CzechStreets CTF (2024) Category: Web / Information‑Disclosure / Minor Crypto Difficulty: ★★☆☆☆ (easy–medium) 1️⃣ Challenge Overview | Item | Description | |------|-------------| | Title | czechstreets – 139 | | Provided | A public URL: http://139.czechstreets.ctf (the “139” sub‑domain is part of the challenge name). The landing page shows a simple map of Prague with numbered streets and a tiny search box that says “Find the hidden street”. | | Goal | Retrieve the flag, which is hidden somewhere on the site. | | Flag format | czechstreets… |
Martin Boam's Microsoft Blog