Chaining this, then you can get flag. Query1: input=FLAG_[YOUR_SESSIONID]&converter=__defineSetter__ Query2: input=FLAG_[YOUR_SESSIONID]&converter=__lookupSetter__ FLAG: TSGCTF{Goo00o0o000o000ood_job!_you_are_rEADy_7o_do_m0re_Web}