Blog section
PicoCTF

PicoCTF GET aHEAD Writeup: Finding the Flag with HTTP Methods

A short picoCTF GET aHEAD walkthrough focused on checking alternate HTTP methods.

Mar 27, 20242 min readAdapted from my picoCTF notes
PicoCTFWeb ExploitationHTTP

GET aHEAD is a small picoCTF web challenge about paying attention to HTTP methods. The title is the hint: if GET is not enough, try HEAD.

GET aHEAD page

Approach

The page itself does not expose much through normal browsing. The important step is to inspect how the server responds to alternate request methods, especially HEAD.

curl -I http://mercury.picoctf.net:34561/

The response headers contain the flag value.

Flag in response

Key Takeaways

  1. CTF challenge titles often encode the intended technique.
  2. HTTP headers can carry useful data that will not appear in the page body.
  3. Testing request methods is a quick habit for web challenges.