Skip to main content
picoCTF Solutions
picoCTF 2026Web ExploitationMedium

North-South picoCTF 2026 Solution

Only one region routes to the server holding the flag, so read the config and request the URL through a VPN there.

Published: March 20, 2026Updated: September 20, 2026

Description

I've set up geo-based routing - can you outsmart it? Access to the real service is restricted based on your geographic location. Only requests from a specific region are routed to the server that holds the flag.

Setup

Launch the challenge instance and note the URL.
Get a VPN service with an Iceland server (e.g. ProtonVPN, Mullvad, or a browser extension like Browsec that lets you pick a country). Connect to an Iceland exit before proceeding.

Solution

Want to try it yourself first?

The guided walkthrough reveals hints one step at a time.

Walk me through it
  1. Step 1Geo-restriction: read the config and bypass with a VPN
    Observation
    The description mentions geo-based routing, and the linked Nginx config routes to the flag server only when the GeoIP country code is IS. Come in through an Iceland exit node.
    The challenge exposes its routing configuration (a config file linked from the instance page). Reading it shows the gate is a literal country-code check - if ($geoip_country_code = IS) routes to the flag server, everyone else goes elsewhere. IS is the ISO code for Iceland. Connect to a VPN server located in Iceland so your requests appear to come from an Icelandic IP. Free options include ProtonVPN, Windscribe, or browser extensions like Browsec where you can select Iceland as the exit country. Tor with ExitNodes {is} also works as an alternative if you prefer not to use a VPN.
    bash
    # Read the provided config first - it names the IS gate outright.
    bash
    # After connecting your VPN to an Iceland server, verify your apparent IP:
    bash
    curl -s https://ipinfo.io/json    # confirm 'country': 'IS'
    bash
    # Alternative: Tor with Iceland exit nodes (if you prefer not to use a VPN)
    bash
    # sudo apt install tor
    bash
    # echo 'ExitNodes {is}' | sudo tee -a /etc/tor/torrc
    bash
    # echo 'StrictNodes 1' | sudo tee -a /etc/tor/torrc
    bash
    # sudo systemctl restart tor

    Expected output

    {
  "ip": "...",
  "country": "IS",
  "region": "...",
  ...
}
    What didn't work first

    Tried: Spoof the X-Forwarded-For or X-Real-IP header to an Icelandic IP address in the curl request.

    An X-Forwarded-For header carrying an Icelandic address does not move a server-side GeoIP check. Nginx derives the country from the actual TCP connection, not a forwarded header, unless the config is written to trust one. The gate sees your real source address and blocks it.

    Tried: Select any European country in the VPN settings instead of specifically Iceland.

    The config compares against the exact ISO code for Iceland, not a region. A German, Dutch, or Swedish exit node reports its own code, none of which match, and the gate still blocks you. Only an Icelandic exit satisfies it.

    Learn more

    Geo-based routing (also called geolocation-based access control) uses the requester's IP address to determine their geographic location and serve different content or restrict access accordingly. Nginx and other reverse proxies implement this using GeoIP databases like MaxMind's GeoLite2, which map IP ranges to country codes. A simple Nginx config might use if ($geoip_country_code != IS) { return 403; } to block non-Icelandic traffic.

    VPNs (Virtual Private Networks) tunnel your traffic through a server in another country, making your requests appear to originate from that server's IP address. This is the most common and accessible way to bypass geo-restrictions. Many VPN providers offer free tiers with limited bandwidth and server selection that are sufficient for CTF challenges. Browser extensions like Browsec provide an even lighter-weight option for browser-based challenges. Tor with ExitNodes {is} is an alternative that works the same way by routing your traffic through an Icelandic exit relay, though Iceland has fewer Tor exit nodes than larger countries, which can make circuit building slower.

    In real-world security, geo-blocking is widely used as a coarse access control layer but is considered a weak defense because it is trivially bypassed by VPNs, proxies, and Tor. It has legitimate uses for regulatory compliance (e.g., GDPR geo-restrictions) but should never be relied upon for security-critical access control. This challenge demonstrates exactly why IP-based geolocation is an unreliable trust signal.

  2. Step 2Request the challenge URL through the Iceland VPN
    Observation
    The verification step reports the country as IS, so the gate will pass and the request routes to the flag server.
    With your VPN or proxy routing through Iceland, your request appears to originate from an Icelandic IP. The geo-check passes and you are routed to the flag server.
    bash
    # With VPN active and connected to Iceland, confirm country first:
    bash
    curl -s https://ipinfo.io/json    # should show 'country': 'IS'
    bash
    # Then hit the challenge URL:
    bash
    curl http://<HOST>:<PORT_FROM_INSTANCE>/
    bash
    # If using Tor as the alternative proxy:
    bash
    curl --proxy socks5h://localhost:9050 http://<HOST>:<PORT_FROM_INSTANCE>/
    What didn't work first

    Tried: Hit the challenge URL directly without first verifying the VPN is connected and showing an Icelandic IP.

    VPN clients fail quietly: they connect to a different server than you picked, or drop back to your local address after a timeout. Without checking your apparent country first, you send from your real IP, get a 403 or a redirect, and cannot tell whether the approach was wrong or the tunnel was. Verify before hitting the gate.

    Tried: Use 'curl --proxy socks5://localhost:9050' (without the 'h' suffix) for Tor proxying.

    With plain socks5, curl resolves the hostname locally before handing the connection to Tor, which leaks DNS and fails outright if the host does not resolve from your machine. The socks5h form delegates resolution to the proxy, which .onion addresses require and which avoids the leak.

    Learn more

    Verifying your apparent IP and country before attempting the bypass is good practice. Services like ipinfo.io return a JSON response with your detected country code, so you can confirm the VPN or proxy is working correctly before hitting the challenge endpoint.

    This same technique applies in penetration testing scenarios where testers need to simulate traffic from specific geographic regions. Many bug bounty programs require testing from specific regions or networks, and a VPN or Tor exit node selection provides a way to accomplish this. See the networking tools guide for more on proxying and verification patterns.

Interactive tools
  • URL Encoder / DecoderEncode and decode URL-encoded (percent-encoded) strings. Useful for web exploitation challenges involving query parameters, form data, and HTTP headers.

Flag

Reveal flag

picoCTF{g30_b453d_rOu71n9_...}

The Nginx config routes Icelandic IPs to the flag server. Connect to a VPN server in Iceland (or use Tor with ExitNodes {is}) so your requests appear to originate from Iceland.

Key takeaway

GeoIP access control assumes an IP address reflects where someone physically is, when an address is only an identifier that routing through a VPN, proxy, or exit node in the target country changes at will. Geolocation is fine for personalizing content and meeting coarse regulatory requirements, and it is not a security boundary. A system relying on it alone falls to anyone with a cheap VPN subscription.

Related reading

Useful tools for Web Exploitation

Where to go next

Try these next