Space Explorer HTB lab

target:A lost space mission control system suffers from flawed authentication logic between its Sender and Receiver services.

Application Flow

1. The user sends a JSON request to the Sender (Go).
2. The Sender parses the JSON and checks if action == "getcosmic".
3. If valid, the Sender forwards the raw request body to the Receiver (Python).
4. The Receiver parses the same JSON body and executes the action.

Key Difference: Case Sensitivity

Go (encoding/json)Case-insensitive key matching. Duplicate keys: last value wins.

Get AlvaGad’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Python (dict)Case-sensitive. "action" and "Action" are different keys.

Sender (Go)

• Sees "action" and "Action" as the same field (case-insensitive).
• Last value wins → requestData.Action = "getcosmic".
• Validation passes ✅ → forwards the raw body to Python.

Receiver (Python)

• Sees "action" and "Action" as two different keys.
• data["action"] returns "getSecureCode".
• Executes getSecureCode and returns the flag