Challenge

A Ruby app fronted by nginx. The landing page plays on the Sinatra framework with a line about Sinatra not knowing this ditty, and shows a sample route.

1
2
3

get '/a' do
  "Hello World"
end

Approach

nginx had a stack of optional modules switched on.

50-mod-http-geoip2.conf  50-mod-http-image-filter.conf  50-mod-http-xslt-filter.conf
50-mod-mail.conf  50-mod-stream.conf  70-mod-stream-geoip2.conf

The part that mattered was the proxy_pass to the Ruby backend. It was written loosely enough that the proxy gave away where it was actually forwarding.

Solution

The misconfigured proxy_pass leaks the internal hostname of the upstream Ruby app, and that hostname is the flag.