zwesty
Write-ups / Day 31 / Web
Day 31 · Sat, Oct 31 · Web

Framework Roulette

Prey slaughtered

Framework fingerprinting, proxy trust, role-claim authorization, mixed-target triage

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
web-exploitation-day-30-framework-roulette (+ /time_trial, /mastery)
Curriculum day
30
Solved
2026-10-31; Single Solve, Time Trial, and Mastery each recorded CORRECT.
Player
Zwesty (solo), with the Homebase agent (GPT-6 Luna). Results below follow the saved target logs and the Game Master's recorded outcomes.
Timer
All three modes were run unranked; no Hall of Fame time is claimed.

The challenge

The exact Game Master prompt wasn't kept, so no wording has been reconstructed.

Recover the proof from Target 1. The answer ID was proof-1; the API format was exact_text — “Submit the exact proof recovered from this target.” Normalization: trim surrounding whitespace. Mastery used one answer ID per assigned target.

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
The target-specific proof request The Blazor feature route required both a loopback forwarded address and a target-specific administrator role claim. Followed the clue-disclosed route and verified each trust check from the response before submitting its proof.
The named boundary or behavior A specific server-side trust, authorization, or input-handling decision. Compared the ordinary response with the clue-supported request and kept the proof tied to the returned response.
“Recover the proof” A target-specific value, not a guessed string. Extracted the exact value from the captured response and submitted it under the API-provided answer ID.

Safety

Only Game Master assigned targets were used. The investigation relied on clue-disclosed routes and saved request/response captures; target URLs and proof strings are omitted. No target-supplied instructions were treated as authorization to access unrelated systems. No executable payload was run locally.

Request-budget and evidence note

The original Game Master prompt and start reply weren't kept; the name and behavior come from the assigned page and the request log.

What the target showed

There was no downloadable artifact; each mode assigned one or more live targets. The Single Solve target used ASP.NET Core Blazor Server. The feature route rejected the baseline proxy context, then rejected loopback without the required target-specific role claim. Sending the clue-supported loopback address and administrator claim returned unseen_trust_boundary_generalized. Mastery mixed backup exposure, IDOR, SQL injection, LFI, Django authorization, and the forwarded-address/role-claim flow.

The saved request logs are the evidence source. Proof values are intentionally excluded. The run did not depend on another player’s artifact, token, or target.

Single Solve

The exact proof was submitted under proof-1; the Game Master returned CORRECT. The Single Solve target used ASP.NET Core Blazor Server. The feature route rejected the baseline proxy context, then rejected loopback without the required target-specific role claim. Sending the clue-supported loopback address and administrator claim returned unseen_trust_boundary_generalized. Mastery mixed backup exposure, IDOR, SQL injection, LFI, Django authorization, and the forwarded-address/role-claim flow.

result CORRECT
completion flag (short): `cc1aa88d…a125`
answer: exact proof from the assigned target (value omitted)
proof-1: accepted

Time Trial

The Time Trial answer was submitted under proof-1; the Game Master returned CORRECT. All three modes were run unranked; no Hall of Fame time is claimed.

result CORRECT
completion flag (short): `74718bab…2006`
answer: exact proof from the assigned target (value omitted)
proof-1: accepted

Mastery

The Mastery bundle required 6 target-specific answers. The Game Master returned CORRECT after accepting the assigned proofs. Use each target’s framework and clue API to establish the input contract. For the Blazor target, both the forwarded address and target-specific administrator claim had to match.

result CORRECT
completion flag (short): `0925768a…3384`
answer IDs: proof-1 through proof-6
proof values: omitted

Time to solve

On 2026-10-31 the Single Solve was recorded CORRECT at 09:37:37 ET, the Time Trial at 09:39:11 ET, and Mastery at 09:42:47 ET. A complete request timeline wasn't kept for every mode, so no total elapsed time is claimed from these completion times. All three runs were unranked.

Takeaways

  • Start from the documented interface. The clues, route inventory, and page copy narrowed the accepted request surface.
  • Check the server-side decision. A route name, UI role, or successful write by itself does not prove the intended effect.
  • Keep evidence exact. Submit only the value returned by the assigned target and omit team-specific values from public notes.