Challenge

An app where /admin/flag was blocked at the front, but the proxy and backend disagreed on URL decoding.

Approach

Percent-encode a character in the path so the proxy sees a different string than the backend resolves. Encoding the a of admin as %61 slips past the block and the backend still routes it to /admin/flag:

GET /%61dmin/flag HTTP/1.1
Host: chall.ehax.in:9098

The flag came back. abl found the bypass; I ran and submitted it. This is the same class of bug as BITSCTF’s rusty-proxy that weekend, seems like this class is making a surge in the CTF community!