Cookie Monster Secret Recipe


We start with a plain login page:
I try with some default credentials admin:admin
, and get an error:
With the hint to check my cookies, I use EditThisCookie2 and see a Cookie called secret_recipe
(You can also view your cookies with a web proxy like Burp Suite, in browser storage, etc):
cGljb0NURntjMDBrMWVfbTBuc3Rlcl9sMHZlc19jMDBraWVzXzk2RjU4REFCfQ%3D%3D
This is URL encoded (can be seen by the %3D
which is equal to =
) and this also looks like Base64!
I do this in CyberChef to decode it. I use URL Decode then From Base64:
Flag: picoCTF{c00k1e_m0nster_l0ves_c00kies_96F58DAB}
Related Writeups
3v@l
ABC Bank's website has a loan calculator to help its clients calculate the amount they pay if they take a loan from the ...
n0s4n1ty 1
A developer has added profile picture upload functionality to a website. However, the implementation is flawed, and it p ...
WebSockFish
Can you win in a convincing manner against this chess bot? He won't go easy on you! Hint: Try understanding the code an ...