5 min read
BITSCTF 2026 — rusty_proxy Writeup
A Rust reverse proxy guards /admin with a naive prefix check. It lowercases the path but never decodes it, so a percent-encoded byte slips the request past the proxy and straight into the Flask route that returns the flag.
#CTF#Cybersecurity#Web