You have already used the Host header to select a virtual host. Its value is supplied by the client independently of the address used to open the connection. Send the authority this service expects and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

HTTP header fields are extensible, so applications can define fields beyond the standardized set. Add the custom field this service requires and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

An HTTP method is the first token of the request line, and servers can define extension methods beyond familiar ones such as GET and POST. Send the method this service expects and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

The final token of an HTTP/1-style request line identifies the protocol version. Ordinary clients generate this token from a version they support rather than accepting an arbitrary value. Construct the request line this service expects and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

Content-Length tells an HTTP/1.1 server exactly how many following bytes belong to the request body. Set the length and contents this service expects and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

You have seen proxies record client addresses in X-Forwarded-For. An application that trusts this field without a trusted proxy lets the client choose its apparent address. Exploit that misplaced trust and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

An HTTP/1.1 connection can carry multiple requests, so every component must agree where each request ends. Content-Length counts body bytes, while chunked Transfer-Encoding marks the end with a zero-sized chunk. Here the frontend follows Content-Length, but the backend follows chunked framing. Exploit the boundary disagreement to reach the protected admin route and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

Now reverse the framing disagreement: the frontend follows chunked Transfer-Encoding, while the backend follows Content-Length. Desynchronize their request boundaries, reach the protected admin route, and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.