Apprentice
← all rooms
Weekly Expert

Weekly Hard Challenge

Progressive multi-stage hard room. Clear all three.

Mission briefing

Challenge Arena rotates a three-stage hard puzzle room every week. Each stage hides its unlock behind obscure parameters, headers, or combo tricks. Clear all stages in order to prove you can hunt without hints from the task list.

0 / 3 tasks 0 / 55 pts

Objectives

  • Stage 1 hidden params
  • Stage 2 secret header
  • Stage 3 final boss
Task 1 Stage 1 Hard 15 pts

Scenario

Challenge Arena stage one hides admin features behind non-obvious query switches. The default page looks innocent until the right parameters are present. Unlock stage one and capture its flag.

Your approach

  1. Load stage one and inspect HTML comments or hidden hints.
  2. Try debug and admin boolean query parameters together.
  3. Reload until the page reveals the stage one success message.
  4. Submit the stage one flag.

Hidden parameter puzzle.

Open lab →
Hint

?debug=1&admin=true

Task 2 Stage 2 Hard 15 pts

Scenario

Stage two remains locked until stage one is cleared, then expects a secret request header. The key material is leaked somewhere in the prior stage output. Send the correct header to retrieve the stage two flag.

Your approach

  1. Complete stage one so stage two becomes reachable.
  2. Find the header name and key in comments or prior responses.
  3. Request stage two with that custom header attached.
  4. Copy the stage two flag from the response.
  5. Submit that flag.

Secret header (unlocks after stage 1).

Open lab →
Hint

HTML comment leaks the key

Task 3 Stage 3 Expert 25 pts

Scenario

The final stage combines a template-style name trick with a boss header check. Both the query/body input and a specific header must match expected values. Clear the boss stage to finish the weekly room.

Your approach

  1. Open stage three after completing earlier stages.
  2. Set the name field to an expression that evaluates on the server.
  3. Add the boss clear header shown in weekly hints or prior stages.
  4. Read the weekly clear flag from the success output.
  5. Submit the final boss flag.

Final boss combo.

Open lab →
Hint

name=7*7 with header X-Boss: clear