Vulnerability Overview
Sensitive data was stored in a custom HTTP response header, only visible when using the HEAD method. Standard browser GET requests receive the header but do not display it in the page body — however curl and Burp Suite expose all response headers trivially.
Exploitation
The challenge name itself was the hint: "GET aHead" — HEAD is an HTTP method. Issuing a HEAD request with curl returned the flag in a custom response header:
curl -v --head http://[target]/index.php
# Response:
flag: picoCTF{r3j3ct_th3_du4l1ty_8b13f07}HTTP Methods Reference
| Method | Purpose |
|---|---|
GET | Retrieve a resource including its body |
HEAD | Same as GET but returns only headers — useful for checking metadata without downloading content |
POST | Submit data to the server for processing |
OPTIONS | Enumerate supported HTTP methods for a resource |
PUT | Upload or replace a resource at a specific path |
Key Insight: HTTP response headers are not hidden — they are visible to any client that sends a request, including curl, Burp Suite, and browser developer tools. Never store credentials, tokens, or sensitive data in response headers. The HEAD method is a standard pentester tool for header enumeration without triggering a full response body download.