0

I was playing a CTF and got stuck. When seeing the source code through web browser reveals nothing but when we send the request through curl it reveals out HIDDEN directory. How is it even possible? Does that mean we should now double check the source code by using curl too?

Improve this question
1
  • 1
    Without an example, it will be difficult to answer.
    – schroeder ♦
    Aug 18, 2018 at 20:59

1 Answer 1

Reset to default
2

Browsers and curl should provide the same code, unless the server inspects the headers (like for the user-agent string) and sends the different code to different clients that connect.

This is not uncommon when trying to create a complex site that does not render well on older browsers. But in a CTF, it's a simple way to show completely different info to different browsers/clients.

Improve this answer
4
  • Means in CTF, it is very easy to set the response on User-agent based. If it found CURL then it will present a different page? BTW sorry for my bad presentation. :)
    – Utkarsh Agrawal
    Aug 18, 2018 at 21:26
  • 1
    yes, it inspect the user-agent string. It's very easy to deliver different content based on user-agent string even outside of a CTF.
    – schroeder ♦
    Aug 18, 2018 at 23:24
  • 1
    It might not even be UA-based but based on some other property.
    – forest
    Aug 19, 2018 at 3:23
  • Okay, Thanks for the clarification. Really for once, I was really worried about this.
    – Utkarsh Agrawal
    Aug 19, 2018 at 7:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .