GET /api/streets?offset=138&limit=1000000 Running the request:
[ "id": 139, "name": "Smetanova", "slug": "smetanova", "metadata": "eyJmbGFnIjoiY2hlY2hzdHJlZXRzeyBmbGFnX3JlYWxseV9lbWFpbF9odG1sIH0ifQ==" ] The field metadata looks like Base64. Decoding it: czechstreets 139
curl -s "http://139.czechstreets.ctf/api/streets?offset=138&limit=1000000" | jq . Result: GET /api/streets
The challenge looks innocuous – a tiny web‑app that lets you query street names. The trick is that the back‑end leaks data via an undocumented API and the flag is encoded in the metadata of a particular street entry (street #139). 2.1 Browsing the site $ curl -s http://139.czechstreets.ctf Result (truncated): czechstreets 139