BrunnerCTF 2026 - Welcome Aboard (Web)
Summary The Brunnerne Inc. internal wiki sits behind layered infrastructure. Direct access to /wiki/internal/flag (hinted by robots.txt ) returns a hard 403 Access is forbidden. from Kestrel. The platform, however, accepts both Content-Length and Transfer-Encoding: chunked on the same request. A classic CL.TE request-smuggling payload lets the front-end treat the whole thing as a single POST…
The Brunnerne Inc. internal wiki is protected by multiple layers of infrastructure, making it challenging to access. However, by exploiting a vulnerability in how the platform handles requests, it's possible to bypass the prohibited path and retrieve a restricted article containing a flag. The initial attempt to access the internal flag directly from the wiki results in a 403 Forbidden error, as indicated in the robots.txt file and confirmed through direct requests.
Upon closer inspection, it becomes apparent that the front-end and the Kestrel server disagree on how to process requests when both Content-Length and Transfer-Encoding: chunked are included. Specifically, the front-end trusts the Content-Length value and processes the entire request as a single unit, while Kestrel, following the Transfer-Encoding: chunked specification, terminates the request prematurely, and then interprets any subsequent data as a new, separate request.
By crafting a request that leverages this discrepancy, an attacker can smuggle an additional, unauthorized GET request for the internal flag. This smuggled request bypasses the path-based authorization middleware, allowing Kestrel to process and reveal the flag with its contents: "brunner{00ps_th4t_p4g3_w4s_1nt3rn4l}".
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
