Knowledge Base

miptctf

Two Flask services: main app sends search results to internal censor via HTTP GET. Mode parameter has no length validation. Werkzeug URL length limit creates binary oracle: long text (found) triggers 414 error, short text (not found) succeeds. Error response bypasses XOR+SHA256, enabling character-by-character flag brute force.