GCtf2017---Forbidden(山路十八弯各种要求报文格式+加解密)

注释提示要本机访问，各种改头部没用，后来发现改成localhost才行，也是醉了，然后后续每次修改都会有个提示，改Host啊，改Referer，改UA什么的，一步一步来就能得到最后flag。参考师兄

GET / HTTP/1.1
Host: www.topsec.com:80
X-Forwarded-For:localhost
x-requested-with: XMLHttpRequest
Proxy-Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64;compatible; MSIE 4.0) .NET CLR 8.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
DNT: 1
Cookie: login=4e7a51334d6a63314e6a553d
Referer: http://www.baidu.com
Accept-Encoding: gzip, deflate
Accept-Language: de-DE,de;q=0.8

提示不要直接粘贴到bp,必须要一步步来，上面是当作模版。

将login进行解密：hex->base64->hex为false

用同样的加密方法加密true，密文：4e7a51334d6a63314e6a553d