writeups/2021/corctf/tricks.md

494 B

tricks

phpme: log all submitted post data with nginx

(to capture a flag POSTed by an adminbot)

you can avoid having to write any code and use pure nginx config for this lol

i'm putting this here because i don't wanna write up phpme but this is a cool thing i found out in the process

log_format postdata $request_body;

server {
    location /flagzone {
        access_log /var/log/nginx/flags.log postdata;
        echo_read_request_body;
        # ...
    }
    # ...
}