WebVerse

Header Hunt

Arc Logistics — a mid-sized regional freight carrier — just launched their public shipment tracking site. The build team rushed to hit the Q2 deadline and merged a debugging branch the night before launch. Nobody asked what got left behind.

Minatour

01 Jun 2026 — 1 min read

Room Description

https://dashboard.webverselabs-pro.com/challenges/header-hunt

Scenario

Arc Logistics — a mid-sized regional freight carrier — just launched their public shipment tracking site. The build team rushed to hit the Q2 deadline and merged a debugging branch the night before launch. Nobody asked what got left behind.

Objective

Arc Logistics ships a shiny new tracking portal. Marketing loves it. A developer didn't quite clean up after themselves before launch.

Initial Analysis

Now, this is a pretty simple challenge, hence why it is tagged as Basics, since this is a starting point for the Junior Web Penetration Tester learning path. We have a web application that we can browse through.

Everything seems proper, until you actually go through your Requests and see what is being sent and received.

Finding the bug

Opening up Burp Suite and looking through the HTTP History we can see a pesky little header that is probably left over from the development build holding the flag.

You can also see the headers being sent and being received through the Network tool in DevTools.

Goat Gear Garage

Kyle opened Goat Gear Garage with a single 1972 Triumph Bonneville and a handshake loan. Twenty years later the inventory spans sixty bikes and the shop is still the same three bays. The website went live in 2019 and hasn't had a code review since.

Briarcliff Foundation

Briarcliff Foundation has accepted humanities and historical-preservation proposals through the same Fluxx-style portal since 2018. The withdraw-application control was added late in development — and shares plumbing with the committee's own review tooling.

Salt Brook Pilates

Salt Brook Pilates is a founder-led studio in the Hudson Valley running reformer classes out of two storefronts. The new profile endpoint went live without a strong-params review — the form only ever submitted four fields, so nobody worried about what else the API would accept.

Heartwood Outfitters

Heartwood's site was built in a long weekend by a co-founder who reads more about fly-fishing than web security. The reset flow uses a 4-digit numeric code; the verify endpoint has no rate-limit, no captcha, and no lockout — so the 10,000-code space is fully enumerable.