Czechstreets 139 _hot_ Instant

<form method="GET" action="/search"> <input type="text" name="q" placeholder="Street name…" /> <input type="submit" value="Search" /> </form>

In short: that lets us read arbitrary street objects, including the hidden one with id = 139 . 4️⃣ Exploiting the Bug 4.1 Crafting the request We want the object with id = 139 . The API returns records in order of id . By setting offset=138 and a huge limit we can retrieve the 139th entry: czechstreets 139

<div id="result"></div> </body> </html> No obvious clues, but the form submits a GET request to /search?q=… . Running gobuster (or dirsearch ) against the host revealed a few hidden routes: By setting offset=138 and a huge limit we

"flag":"czechstreets flag_really_email_html " The flag is clearly embedded in the JSON. A one‑liner to fetch and decode in one go: Result:

echo "eyJmbGFnIjoiY2hlY2hzdHJlZXRzeyBmbGFnX3JlYWxseV9lbWFpbF9odG1sIH0ifQ==" | base64 -d Gives:

curl -s "http://139.czechstreets.ctf/api/streets?offset=138&limit=1000000" | jq . Result: