# Step176 local mini CTF

Observe five challenges, submit flags and compare the same requests against the fixed mode. Run this deliberately weak app only on your own computer's loopback interface. Do not publish it as a service or enter real personal data. Administrator privileges are unnecessary.

## Install and start

Extract into a new directory and change to it. Install Python 3. The pinned dependency versions are the tested versions, not a claim of being latest. Dependency installation requires Internet access; the installed lab needs no external service.

Linux/macOS:
```sh
python3 -m venv .venv
.venv/bin/python -m pip install -r requirements.txt
.venv/bin/python step176_ctf.py --lang en --port 8176
```

Windows PowerShell:
```powershell
py -m venv .venv
.venv\Scripts\python.exe -m pip install -r requirements.txt
.venv\Scripts\python.exe step176_ctf.py --lang en --port 8176
```

Open http://127.0.0.1:8176/ in a browser. The app binds only to 127.0.0.1, with debugger and reloader disabled. Stop your own server with Ctrl+C. If the port is occupied, use a free port such as `--port 8178` and update all request URLs. Do not force-stop unrelated processes.

## Exercise

1. Before reading the source or solutions, write five hypotheses in worksheet.en.md.
2. Inspect HTML comments, robots.txt, notice response headers, entrance cookies and profile IDs.
3. Submit the challenge number and complete flag. A matching format alone does not prove correctness; duplicate correct submissions do not increase the score.
4. Separate `/score` from your record of independent, hinted or reproduced solves. The score is one shared in-memory practice state and resets with the server. This is not a multi-user competition service.
5. In another terminal, start the fixed comparison:
```sh
.venv/bin/python step176_ctf.py --mode fixed --role user --lang en --port 8177
```
Use `.venv\Scripts\python.exe` on Windows. Backup, the admin=true cookie and profile1 should return403; profile2 should return200. Stop the comparison server and restart with `--role admin`: the three admin routes should return200. The role is an identity fixture chosen at server startup, not a login implementation.

## Reproduce and inspect sessions

```sh
.venv/bin/python reproduce.py
.venv/bin/python session_demo.py
```
Use the Windows Python path on Windows. The reproducer creates and closes its own loopback servers; it does not stop manual servers or unrelated services. Check `status: pass` and the named checks. The session example uses Flask's test client without a network listener: signed cookie data is readable, but modifying it while retaining the original signature yields an empty session.

Flask's default session uses a signed client cookie, unlike a server-side session store. Signing is not encryption and does not replace authorization. `curl -I` makes a HEAD request; `curl -i` includes headers with a GET response. Use `curl.exe` on Windows.

Verification JSON files include environments, dependency versions and source hashes. Windows ran curl.exe; the isolated Linux container verified HTTP with Python. macOS and physical phones were not tested. Automated success does not prove an independent solve or production security.

Lesson: https://infosec.3001.co.kr/en/step-176-ctf-first-taste-1-five/