Challenge

A web server that answers most requests with a 403.

Solution

The 403 page itself carried the flag. The same value was also set in a custom Server response header, so reading the raw response headers gave it up a second way.