Author: @axi0mXInformation given: "Watch your heads!"Assuming it was related to an HTTP HEAD request, I ran the following command:$ curl --head https://asis-ctf.ir/challenges/HTTP/1.1 302 FoundServer: nginxDate: Mon, 12 Sep 2016 02:05:42 GMTContent-Type: text/html; charset=utf-8Connection: keep-aliveVary: Accept-Language, CookieX-Frame-Options: SAMEORIGINContent-Language: faLocation: /accounts/login/?next=/challenges/Strict-Transport-Security: max-age=15768000; includeSubDomains; preload;CTF-Level: Final 2016X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockFlag: QVNJU3szMWE0ODM5MDBiODU3NjQyNmNjY2RmNTU0MDJiOWRkNn0K; base64Decoding base64 gets us the flag:$ echo QVNJU3szMWE0ODM5MDBiODU3NjQyNmNjY2RmNTU0MDJiOWRkNn0K | base64 --decodeASIS{31a483900b8576426cccdf55402b9dd6}