Skip to main content

21. Extracting Flags Through Log Leaks in CTFs

A surprisingly powerful vector in web and reversing CTFs is the log leak. The key is to identify quickly what gets logged and where.

1) Find Log Collection Paths​

  • Inspect /var/log, application log directories, and container logs on stdout
  • Check whether error handlers or debug middleware log request bodies or headers

2) Design Triggering Input​

  • Insert a marker such as FLAG? into User-Agent or X-Forwarded-For
  • Trigger a decoding error and check whether the stack trace exposes sensitive values

3) Bypass the Read Gate​

  • Access log files through LFI or Path Traversal
  • If a "recent logs" API exists, abuse its pagination or filters

Logs reveal a developer's unconscious assumptions. In a CTF, attacking those assumptions is often the fastest route.