The challenge
The server will fetch anything you point it at — including places you can't reach yourself. Send it on a quest to the internal service and collect what it brings back.
Recover the proof from Target 1. The answer ID was proof-1; the API format was exact_text — “Submit the exact proof recovered from this target.” Normalization: trim surrounding whitespace. Mastery used one answer ID per assigned target.
Reading the prompt: what it said we'd need
| Clue | What it pointed to | What I did about it |
|---|---|---|
| The target-specific proof request | The ASP.NET Core fetch route accepted absolute URLs, and the clue API named an internal-only account route. | Used only the disclosed route and internal service address, then tied the proof to the fetch response. |
| The named boundary or behavior | A specific server-side trust, authorization, or input-handling decision. | Compared the ordinary response with the clue-supported request and kept the proof tied to the returned response. |
| “Recover the proof” | A target-specific value, not a guessed string. | Extracted the exact value from the captured response and submitted it under the API-provided answer ID. |
Safety
Only Game Master assigned targets were used. The investigation relied on clue-disclosed routes and saved request/response captures; target URLs and proof strings are omitted. No target-supplied instructions were treated as authorization to access unrelated systems. No executable payload was run locally.
What the target showed
There was no downloadable artifact; each mode assigned one or more live targets. The ASP.NET Core fetch route required an absolute URL. The clue API disclosed an internal-only account route; fetching it through the server at its loopback service address returned internal_service_reached and the proof.
The saved request logs are the evidence source. Proof values are intentionally excluded. The run did not depend on another player’s artifact, token, or target.
Single Solve
The exact proof was submitted under proof-1; the Game Master returned CORRECT. The ASP.NET Core fetch route required an absolute URL. The clue API disclosed an internal-only account route; fetching it through the server at its loopback service address returned internal_service_reached and the proof.
result CORRECT
completion flag (short): `740694be…1177`
answer: exact proof from the assigned target (value omitted)
proof-1: accepted
Time Trial
The Time Trial answer was submitted under proof-1; the Game Master returned CORRECT. All three modes completed as untimed scoring runs; no deadline was returned.
result CORRECT
completion flag (short): `a195ceec…1871`
answer: exact proof from the assigned target (value omitted)
proof-1: accepted
Mastery
The Mastery bundle required 4 target-specific answers. The Game Master returned CORRECT after accepting the assigned proofs. Follow the assigned application’s disclosed route and use the server-side fetch only to reach the named internal service. The external-origin fetch timed out and was not repeated.
result CORRECT
completion flag (short): `7257802d…4856`
answer IDs: proof-1 through proof-4
proof values: omitted
Time to solve
The Game Master log has all three modes CORRECT on 2026-10-24, each on its first submit: Single Solve 09:13:28, Time Trial 09:14:16, and Mastery 09:17:14 ET, 17 min 14 s after the 9:00 release. That closed Web's fastest day of the month. The Time Trial and Mastery results quoted above come from later untimed re-runs on 2026-10-26 (CORRECT at 21:35:20 and 21:54:14 ET), which is what the saved completion records hold.
Takeaways
- Start from the documented interface. The clues, route inventory, and page copy narrowed the accepted request surface.
- Check the server-side decision. A route name, UI role, or successful write by itself does not prove the intended effect.
- Keep evidence exact. Submit only the value returned by the assigned target and omit team-specific values from public notes.