Abusing http misconfigurations

I’m stuck on the “Identifying Unkeyed Parameters” question. I prepared this payload thinking that the unkey parameter is content, but I can’t run it, can you help?

hey @C4RT3L , I’m the same problem. Don’t get it why it’s not working

Dude, we’re doing everything right. Delete the ref parameter, then resend the request after 2 minutes, come to the homepage, only the language part in the url. Click on the Flag tab and get the flag (don’t forget to set it as de).

1 Like

Thanks man, I got the flag! <3

1 Like