0

I was playing a CTF and got stuck. When seeing the source code through web browser reveals nothing but when we send the request through curl it reveals out HIDDEN directory. How is it even possible? Does that mean we should now double check the source code by using curl too?

  • 1
    Without an example, it will be difficult to answer. – schroeder Aug 18 '18 at 20:59
2

Browsers and curl should provide the same code, unless the server inspects the headers (like for the user-agent string) and sends the different code to different clients that connect.

This is not uncommon when trying to create a complex site that does not render well on older browsers. But in a CTF, it's a simple way to show completely different info to different browsers/clients.

  • Means in CTF, it is very easy to set the response on User-agent based. If it found CURL then it will present a different page? BTW sorry for my bad presentation. :) – Utkarsh Agrawal Aug 18 '18 at 21:26
  • 1
    yes, it inspect the user-agent string. It's very easy to deliver different content based on user-agent string even outside of a CTF. – schroeder Aug 18 '18 at 23:24
  • 1
    It might not even be UA-based but based on some other property. – forest Aug 19 '18 at 3:23
  • Okay, Thanks for the clarification. Really for once, I was really worried about this. – Utkarsh Agrawal Aug 19 '18 at 7:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.