Protocol Chain

A legacy console distributes the clues to its protocol across method discovery, response headers, client code, and an encoded result. Reconstruct the chain.

Objective

Combine independent protocol clues into one valid request.
Decode the response according to its declared representation.

Before you begin

Open /challenge/hard/protocol with an HTTP client that supports custom methods and headers.

Concepts

Security behavior often emerges from a sequence rather than one isolated flaw. Record each clue and its source instead of guessing combinations.

A client sends a request with method, target, headers, and optional body. The server returns a response with status, headers, and optional body; headers and bodies answer different questions.

A request includes a method and target, headers, and sometimes a body. The response includes a status, headers, and sometimes a body. Inspect both directions: a browser's rendered page usually shows only the response body. Methods, cookies, authorization, and application state can affect the result; a status code alone is not a complete explanation. The diagram shows a generic exchange, not a station request.

Suggested tools

HTTP client and source viewer: Discover methods and inspect client code.
Hex decoder: Decode only the final payload field.

Tool practice

Rehearse the worked tool exercise before using challenge data.

Make a four-column note: required method, header name, header value, and result encoding. Record where you found each item. Keep -i for HTTP inspection, then copy only the encoded body field into the hex decoder; status and header text are not payload bytes.

Investigation

Observe

Ask the console which methods it supports. Record the advertised method, debug header name, and value stored in the loaded script.

Form a hypothesis

Will one request combining all three produce a typed encoded payload?

Test carefully

Send the advertised method and exact header once, then follow the returned encoding label.

Progressive hints

Hint 1

Send OPTIONS to the console endpoint.

Hint 2

Combine its method and header name with the value in the JavaScript.

Hint 3

Decode the returned payload using the response's encoding field.

Troubleshooting and reset

Check the quoted custom-header name/value and exact method spelling. cURL accepts options before or after the URL. This module is stateless.