{
  "id": 2807677,
  "title": "BrunnerCTF 2026 - Welcome Aboard (Web)",
  "url": "https://urgent.news/2026/08/23/brunnerctf-2026-welcome-aboard-web",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-23T14:49:41.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/exploitnotes/brunnerctf-2026-welcome-aboard-web-391d"
  },
  "original_language": "en",
  "account": "The Brunnerne Inc. internal wiki is protected by multiple layers of infrastructure, making it challenging to access. However, by exploiting a vulnerability in how the platform handles requests, it's possible to bypass the prohibited path and retrieve a restricted article containing a flag. The initial attempt to access the internal flag directly from the wiki results in a 403 Forbidden error, as indicated in the robots.txt file and confirmed through direct requests. Upon closer inspection, it becomes apparent that the front-end and the Kestrel server disagree on how to process requests when both Content-Length and Transfer-Encoding: chunked are included. Specifically, the front-end trusts the Content-Length value and processes the entire request as a single unit, while Kestrel, following the Transfer-Encoding: chunked specification, terminates the request prematurely, and then interprets any subsequent data as a new, separate request. By crafting a request that leverages this discrepancy, an attacker can smuggle an additional, unauthorized GET request for the internal flag. This smuggled request bypasses the path-based authorization middleware, allowing Kestrel to process and reveal the flag with its contents: \"brunner{00ps_th4t_p4g3_w4s_1nt3rn4l}\".",
  "summary": "Summary The Brunnerne Inc. internal wiki sits behind layered infrastructure. Direct access to /wiki/internal/flag (hinted by robots.txt ) returns a hard 403 Access is forbidden. from Kestrel. The platform, however, accepts both Content-Length and Transfer-Encoding: chunked on the same request. A classic CL.TE request-smuggling payload lets the front-end treat the whole thing as a single POST…",
  "key_points": [
    "BrunnerCTF 2026 internal wiki protected by multiple layers",
    "Vulnerability exploited to bypass path and retrieve flag",
    "Request smuggling technique reveals internal flag content"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}