Challenge

A page that gates content behind a paid tier.

Solution

The check is the Referer header and nothing else. Intercept the request in Burp and change the referrer from free.html to paid.html. Total time on this one was about 46 seconds.

Flag

bcactf{fl4g_r3ferr3d_gn3vhx75}