iTranslated by AI

The content below is an AI-generated translation. This is an experimental feature, and may contain errors. View original article
🦙

Writeup for Flag for Switch (AlpacaHack)

に公開
Web
CTF
alpacahack
idea

Problem

This is the challenge called "Daily AlpacaHack 2026/05/18 Flag for Switch".

What I Tried

I checked the distributed files.

index.js
const express = require('express');

const FLAG = process.env.FLAG ?? "Alpaca{REDACTED}";

const app = express();

const html = `
<!DOCTYPE html>
<html>
  <body>
    <h1>Sorry, this page is only available for Switch users</h1>
  </body>
</html>
`;

const htmlForSwitch = `
<!DOCTYPE html>
<html>
  <body>
    <h1>Welcome, Switch user! Here is your flag: ${FLAG}</h1>
  </body>
</html>
`;

app.get("/", async (req, res) => {
  const userAgent = req.headers['user-agent'] || '';
  if (userAgent.includes("Switch")) {
    res.send(htmlForSwitch);
  } else {
    res.send(html);
  }
});

app.listen(3000, () => {
  // Server listens on port 3000
  console.log('Server listening on port 3000');
});

const express = require('express'); calls express, a convenient tool for creating web servers.

const app = express(); launches the web server instance named 'app'.

const html = `
...snip
    <h1>Sorry, this page is only available for Switch users</h1>
...snip
`;

const htmlForSwitch = `
...snip
    <h1>Welcome, Switch user! Here is your flag: ${FLAG}</h1>
...snip
`;

It prepares two types of web pages to return to visitors.

app.get("/", async (req, res) => {
  const userAgent = req.headers['user-agent'] || '';
  if (userAgent.includes("Switch")) {
    res.send(htmlForSwitch);
  } else {
    res.send(html);
  }
});

This handles access to the root URL. It extracts the 'User-Agent' information from the communication data (HTTP request headers) sent by the visitor and stores it in the 'userAgent' variable. Then, it checks whether the string "Switch" is included in the User-Agent string. If it is included, it returns 'htmlForSwitch'; otherwise, it returns the default 'html'. It seems I can obtain the FLAG if I can somehow include the word "Switch" in the User-Agent.

Since I need to tamper with the header, I thought I should use curl or a proxy tool. While I haven't tried this, there is a browser extension called "User-Agent Switcher" that allows changing the User-Agent to anything, which would also work. By sending a request with "Switch" set in the User-Agent, like curl -H "User-Agent:Switch" $URL, I can obtain the FLAG. The '-H' option in curl is used to modify headers.

FLAG

Alpaca{Y0u_can_really_solve_this_cha11enge_with_a_Switch!_Give_it_a_try!}

Discussion