I'm bringing CGI back from the old days!
Beginner Hint: About the Admin Bot
- In this challenge, you are given not only the web application itself, but also an admin bot.
- The admin bot has a cookie containing the flag, and it opens a specified path using Headless Chrome.
- Therefore, your goal is to make the admin bot trigger your payload and send the cookie value to an external server.
- You can prepare your own server as the destination, or use an existing service that lets you receive and inspect HTTP requests.
- If you are still not familiar with how to use the admin bot or how to inspect incoming requests, it may help to first solve Fushigi Crawler and read its writeup.