Writeup author: piprett (Norske Nøkkelsnikere)
There is no handout for the challenge, so I started by starting the instance. The website is very basic, you can register, login, and see the flag. To see the flag you need to be an admin. The challenge description mentions cookies, so we can start by investigating how the website uses cookies. After logging in, there is a role cookie set to user. What would happen if we changed the role to admin?
- Open the instance in Firefox
- Register an account and login
- Go to the admin page, and notice not having permission to view the flag
- Open the devtools and navigate to the "Storage" tab. Open cookies
- Set the value of the
rolecookie toadminby double-clicking on it - Refresh the page
The flag will be displayed: EPT{Cookies_4_the_Win!!}
In real world applications, this is very unlikely to be possible. Most applications use JSON Web Tokens (JWTs) to store authentication data such as user id and role. These tokens are cryptographically signed such that manipulation by the client will be detected. There can of course be weaknesses in these tokens, such as in the "Hackermon" challenge.