Protocol Analysis 3: Missing
metactf
Task: a protocol manual describes the exact Alice-to-Bob plaintext needed to request the flag, but the live service lacks a real Alice side for model 3. Solution: send Bob the expected message directly, exploiting missing sender and counterpart enforcement to receive the flag.
$ ls tags/ techniques/
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Protocol Analysis 3: Missing — metactf
Description
Alice recv: "Hello", B, "this is", A, "give me the flag" Bob send: "here it is", [FLAG]
English summary: the challenge provides the expected plaintext protocol transcript in the manual and a live service at https://protocols.live. The bug is that model 3 does not enforce a real Alice counterpart, so we can send Bob the exact expected request ourselves and read the flag.
Analysis
The PDF already reveals the full message Bob is supposed to receive:
t:Hello|n:bob|t:this is|n:alice|t:give me the flag
On the live service, creating an instance with POST /model/3 returns a conn_id. Trying to interact with Alice fails with:
{"detail":"No alice here, sorry!"}
So this model has no usable Alice endpoint. Sending empty content to Bob also fails with:
{"detail":"Invalid message"}
That shows Bob is validating message structure, but not who actually sent it. If we submit the exact plaintext request from the manual directly to /bob, Bob accepts it and returns the flag. The vulnerability is effectively missing sender validation and missing counterpart enforcement.
Solution
...