1. Notice strange HTTP/1.0 and HTTP/1.1 responses from 404.php2. Guess that those values define leaking flag bits3. Spend hours trying to recover as many bits as possible from constantly crashing server leaking random parts of the flag
Full writeup: https://github.com/p4-team/ctf/tree/master/2019-11-07-defcamp-finals/lucky