---
# System prepended metadata

title: Let's be Transparent about this - Writeup

---

# Let's be Transparent about this - Writeup

This is a sponsor challenge, and visiting the site derp.randori.com, there is a form. However, when you view the source, all form submissions simply redirect to randori.com, which does not feel like part of the challenge.

Also part of the source is a bogus flag, but nothing else of interest is to be seen. Maybe the flag is hidden in the DNS records? Nope, no luck.

Next, inspecting the site a bit more, I checked the server certificate. Haha! Scrolling through, I see that the cert is also valid for derp-dev.randori.com! Finally, a lead!

Visiting derp-dev.randori.com, and there is no response. Checking the DNS records, there are none! Maybe there is a wayback machine entry at archive.org? Nope.

Then I realized it! It's a vhost! on the same IP! Firing up Burp, we can send a request with the Host: derp-dev.randori.com header.

![](https://i.imgur.com/ZGmNvY2.png)

And voila! We get the flag

![](https://i.imgur.com/GGQHNZH.png)
