Door to Door

We're going door to door looking for candy, but I think there's one house that has decided to hide itself on the list...

Choosing a house and clicking on "Start Trick-or-Treating" takes us to /house.php?house=1, that displays house address and list of candies

The house number goes from 1 to 25, each page fetches data via /api/house.php?id=<house-num>

Running a script to enumerate all houses eventually gives the flag:

import requests

base_url = "http://1g0wrfmo.chals.mctf.io/api/house.php?id="

for i in range(1, 26):
    response = requests.get(base_url + str(i))
    if "MetaCTF" in response.text:
        print(f"House {i}: {response.text}")