Scenario

Static files (*.js, *.css) are cached and served to everyone. The origin routes /my-account by prefix and treats characters after a delimiter (;, %2F, …) as insignificant.

Your objective

Cache the victim carlos's account page and read his API key from it. Solved when you submit carlos's API key.

Capture 2 flag(s) and record the exact technique for each step.

Getting started

1. Inspect a real static file's response headers to learn the cache indicator (X-Cache, Age).
2. Request your own /my-account with suffixes — /my-account/foo.js, /my-account;foo.js, /my-account%2ffoo.js — until one returns your data AND caches.
3. Verify with a cookie-less request that the cached copy contains your data.
4. Send carlos the equivalent URL for his account via the "Deliver link to victim" button.
5. Fetch that exact URL unauthenticated and read the key. Submit the working delimiter and the API key as the two flags.

Connecting

Press Launch Lab to build your own instance, then use the How to connect panel — it shows the browser link as soon as the app is running. Hit Stop when you are done, or Relaunch / Reset for a clean copy.

Credentials: wiener:peter; a victim bot named carlos loads its own account page when sent a link.

Hints