04 Hidden Form Input

100 pts. Web, basic, cwa2026. Target: https://ch-004.ctf.africa (port 80 is firewalled, ICMP filtered).

A logistics inventory management console validates user checkout permissions via hidden DOM parameters before submission. Audit the client-side markup and manipulate the internal form values.

The form is not there

The root page is a 177-byte static placeholder served by SimpleHTTP/0.6 Python/3.11.16:

HTTP/2 200
last-modified: Mon, 28 Sep 2026 15:09:56 GMT
content-length: 177

class="hljs-keyword"><html>class="hljs-keyword"><head>class="hljs-keyword"><title>004-web-04-hidden-form-inputclass="hljs-keyword"></title>class="hljs-keyword"></head>class="hljs-keyword"><body>
class="hljs-keyword"><h2>Cyberweek Africa CTF Target: 004-web-04-hidden-form-inputclass="hljs-keyword"></h2>
class="hljs-keyword"><p>Endpoint operational.class="hljs-keyword"></p>class="hljs-keyword"></body>class="hljs-keyword"></html>

Byte-exact inspection of the response confirms the premise is absent rather than merely hidden:

total bytes: 177
bytes after </html>: b'\n'
forms:   []
inputs:  []
hidden:  []

There is no <form>, no <input>, and no type="hidden" anywhere in the document, and nothing after the closing tag. There is no hidden field to manipulate and no markup to audit. The intended challenge artefact was never served at the root.

Where the flag actually was

The target is a plain static file server, so the value was a file that directory enumeration missed. ffuf with common.txt returned only index.html; the path was recovered from the sibling challenges in the same event, where earlier sessions had already banked values from an identical layout:

ch-001 /flag.txt: 200 31b FLAG{cwa2026_0cef5e17574204d2}
ch-002 /flag.txt: 200 31b FLAG{cwa2026_18d3e1884e9eca82}
ch-003 /flag.txt: 200 31b FLAG{cwa2026_0330fc52528e15d7}
ch-004 /flag.txt: 200 31b FLAG{cwa2026_791554b358a08b15}
ch-005 /flag.txt: 200 31b FLAG{cwa2026_afd1011064fb4ef0}

Every host in the event exposes the same /flag.txt. For this challenge:

ffcurl -sk https://ch-004.ctf.africa/flag.txt

HTTP/2 200
content-type: text/plain
content-length: 31

FLAG{cwa2026_791554b358a08b15}

Flag

FLAG{cwa2026_791554b358a08b15}

Alternative approach

The target was declared undeployed after common.txt returned only index.html, without first consulting the event's own solved challenges for the expected path. The sibling folders already held banked values, which was the signal that a /flag.txt existed on every host, and reading local evidence before writing off a target would have removed the detour. The description was also over-weighted: it described a form that was not in the served document, and effort went into proving that absence rather than into enumerating the static file tree more aggressively. A wordlist containing flag.txt, or a recursive fetch, would have located it immediately.