---
description: March 22, 2024
---

# POST

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FPBaeZaQtnNMK0VkfGVny%2Fimage.png?alt=media&#x26;token=57561740-57dd-4db0-9495-1c68a484d365" alt=""><figcaption></figcaption></figure>

First we did try to copy as curl in the web dev tool

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F5YTKAuXWbRFbuuZLKywH%2Fimage.png?alt=media&#x26;token=263bfb5e-b6f4-4204-a4cd-1cd1a7df46e5" alt=""><figcaption></figcaption></figure>

Then this is the result for that

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FRnBvfDoRKbfZ3EWQlQm8%2Fimage.png?alt=media&#x26;token=c2f21c46-1b85-4549-85db-15aa5bd3a45c" alt=""><figcaption></figcaption></figure>

option 1

After we remove some of the headers we can see this

{% code overflow="wrap" %}
```
curl 'http://83.136.254.223:39361/search.php' -H 'Cookie: PHPSESSID=gpsf0oduj0dfflqevvrnj55b3f' -H 'Content-Type: application/json' --data-raw '{"search":"flag"}'
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Feq0ev9GgyAl375KQ1C1I%2Fimage.png?alt=media&#x26;token=efc42040-c66c-4e0f-87b2-ecb7e949ee9f" alt=""><figcaption></figcaption></figure>

option 2

{% code overflow="wrap" %}
```
curl -X POST -d '{"search":"london"}' -H 'Cookie: PHPSESSID=30ij4ep815vbqnmtaqnr3jncuv' -H 'Content-Type: application/json' http://83.136.252.226:56408/search.php

curl -X POST -d '{"search":"flag"}' -H 'Cookie: PHPSESSID=30ij4ep815vbqnmtaqnr3jncuv' -H 'Content-Type: application/json' http://83.136.252.226:56408/search.php
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FmrfZka9AIdEXWzZeKsEI%2Fimage.png?alt=media&#x26;token=bd11a735-9c06-4787-a1b3-2b1c05539bd0" alt=""><figcaption></figcaption></figure>



option 3

{% code overflow="wrap" %}
```
curl -X POST -d '{"search":"flag"}' -b 'PHPSESSID=30ij4ep815vbqnmtaqnr3jncuv' -H 'Content-Type: application/json' http://83.136.252.226:56408/search.php
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F2PPb8BBftt4VWmmwuigt%2Fimage.png?alt=media&#x26;token=4994b3d0-5189-476b-905f-c5a6c2e88b2f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FsRcJtjgQt3hDKmgB4bd3%2Fimage.png?alt=media&#x26;token=26c46b2a-2d1e-47ba-8ce7-952f5d9cffce" alt=""><figcaption></figcaption></figure>
