I was playing a CTF and got stuck. When seeing the source code through web browser reveals nothing but when we send the request through
curl it reveals out HIDDEN directory. How is it even possible? Does that mean we should now double check the source code by using
curl should provide the same code, unless the server inspects the headers (like for the user-agent string) and sends the different code to different clients that connect.
This is not uncommon when trying to create a complex site that does not render well on older browsers. But in a CTF, it's a simple way to show completely different info to different browsers/clients.