> For the complete documentation index, see [llms.txt](https://codingmace.gitbook.io/masterward/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codingmace.gitbook.io/masterward/ctf/2021/picoctf/web.md).
# Web Exploitation
### GET aHEAD \[20 pts] \[Not Solved]
> **Description**
>
> Find the flag being held on this server to get ahead of the competition
**Solution**
a
**Flag:**
### Cookies \[40 pts] \[Not Solved]
> **Description**
>
> Who doesn't love cookies? Try to figure out the best one.
**Solution**
a
**Flag:**
### Scavenger Hunt \[50 pts] \[Not Solved]
> **Description**
>
> There is some interesting information hidden around this site . Can you find it?
**Solution**
a
**Flag:**
### Some Assembly Required 1 \[70 pts] \[Not Solved]
> **Description**
>
>
**Solution**
a
**Flag:**
### More Cookies \[90 pts] \[Not Solved]
> **Description**
>
> I forgot Cookies can Be modified Client-side, so now I decided to encrypt them!
**Solution**
a
**Flag:**
### It is my Birthday \[100 pts] \[Not Solved]
> **Description**
>
> I sent out 2 invitations to all of my friends for my birthday! I'll know if they get stolen because the two invites look similar, and they even have the same md5 hash, but they are slightly different! You wouldn't believe how long it took me to find a collision. Anyway, see if you're invited by submitting 2 PDFs to my website.
**Solution**
a
**Flag:**
### Who are you? \[100 pts] \[Not Solved]
> **Description**
>
> Let me in. Let me iiiiiiinnnnnnnnnnnnnnnnnnnn
**Solution**
a
**Flag:**
### Some Assembly Required 2 \[110 pts] \[Not Solved]
> **Description**
>
> [http://mercury.picoctf.net:15406/index.html
> ]()
**Solution**
a
**Flag:**
### Super Serial \[130 pts] \[Not Solved]
> **Description**
>
> Try to recover the flag stored on this website
**Solution**
a
**Flag:**
### Most Cookies \[150 pts] \[Not Solved]
> **Description**
>
> Alright, enough of using my own encryption. Flask session cookies should be plenty secure! [server.py](https://mercury.picoctf.net/static/26760321c25c9659050a37a707247690/server.py)
**Solution**
a
**Flag:**
### Some Assembly Required 3 \[160 pts] \[Not Solved]
> **Description**
>
>
**Solution**
a
**Flag:**
### Web Gauntlet 2 \[170 pts] \[Not Solved]
> **Description**
>
> This website looks familiar... Log in as admin Site: Filter:
**Solution**
a
**Flag:**
### Some Assembly Required 4 \[200 pts] \[Not Solved]
> **Description**
>
>
**Solution**
a
**Flag:**
### X marks the spot \[250 pts] \[Not Solved]
> **Description**
>
> Another login you have to bypass. Maybe you can find an injection that works?
**Solution**
a
**Flag:**
### Web Gauntlet \[300 pts] \[Not Solved]
> **Description**
>
> Last time, I promise! Only 25 characters this time. Log in as admin Site: Filter:
**Solution**
a
**Flag:**
### Bithug \[500 pts] \[Not Solved]
> **Description**
>
> Code management software is way too bloated. Try our new lightweight solution, BitHug.\
> Source: [distribution.tgz](https://venus.picoctf.net/static/fa09f347d559b6ae3c0824921f38a6ff/distribution.tgz)
**Solution**
a
**Flag:**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://codingmace.gitbook.io/masterward/ctf/2021/picoctf/web.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.