RootMe - HTTP Headers

RootMe – HTTP - Headers

Challenge hint

Content is not the only part of an HTTP response!

Analysis
The message clearly tells us that we should look beyond the response body — most likely in the headers.

Solution steps

1. Intercept the HTTP request using Burp Suite and send it to Repeater.

2. Look at the response headers — you will see this custom header:

   Header-RootMe-Admin: none
   

   (It does not appear in the original request.)

1. Add the same header to your request with the value true:

   Header-RootMe-Admin: true
   

2. Forward / send the modified request → the password will be returned in the response.

Finished. Happy Hacking!

Follow me:

• LinkedIn
• X

```