> For the complete documentation index, see [llms.txt](https://j0luuuu.gitbook.io/ctf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://j0luuuu.gitbook.io/ctf/yctf-weekly-2023/week-2/web/cookie.md).

# Cookie

### Challenge Description

<figure><img src="https://1613628666-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKkuxWaWwvkRd57ql1rtY%2Fuploads%2FXgrJrBahUejQFeJFrcMM%2Fimage.png?alt=media&amp;token=4f3e597f-e632-45d1-8166-be144d5e9018" alt=""><figcaption><p>Challenge Description</p></figcaption></figure>

### Solution

#### Landing Page

<figure><img src="https://1613628666-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKkuxWaWwvkRd57ql1rtY%2Fuploads%2FvEXZQdRzuvJYIUJ2XIzU%2Fimage.png?alt=media&amp;token=2f23a94d-d2c1-4373-b829-64e833a5075e" alt=""><figcaption></figcaption></figure>

#### Directory fuzzing

```sh
gobuster dir -u https://cookiechallenge.pythonanywhere.com/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt
```

<figure><img src="https://1613628666-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKkuxWaWwvkRd57ql1rtY%2Fuploads%2FqhOkIO42SsmezC4lKuiH%2Fimage.png?alt=media&amp;token=23fdd9b5-1e99-4cc4-87d8-f0f018a15343" alt=""><figcaption><p>Gobuster</p></figcaption></figure>

* Visiting `/robots.txt` , we find a secret directory named `/sup3r_s3cr3t_d1r`

<figure><img src="https://1613628666-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKkuxWaWwvkRd57ql1rtY%2Fuploads%2FWYpsLDc0In754bSrRGg1%2Fimage.png?alt=media&amp;token=100c830c-211f-4f90-9816-89b488ad6656" alt=""><figcaption><p>robots.txt</p></figcaption></figure>

* Visiting `/sup3r_s3cr3t_d1r`&#x20;

<figure><img src="https://1613628666-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKkuxWaWwvkRd57ql1rtY%2Fuploads%2F6NyBzDCF8qnd0fpvjLTw%2Fimage.png?alt=media&amp;token=40249584-9536-43ee-9ba3-d806e0173938" alt=""><figcaption></figcaption></figure>

* Visiting `/cookie`, we get a jwt token

<figure><img src="https://1613628666-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKkuxWaWwvkRd57ql1rtY%2Fuploads%2FYMuVxFs4AkN3InFC3XSd%2Fimage.png?alt=media&amp;token=f76debeb-f468-4720-910f-66e59133e986" alt=""><figcaption><p>cookie</p></figcaption></figure>

#### JWT Debugging

* Using [this website](https://token.dev/), we can decode the JWT token

<figure><img src="https://1613628666-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKkuxWaWwvkRd57ql1rtY%2Fuploads%2FB6bWmbFS2gfL9j1Q9zEU%2Fimage.png?alt=media&amp;token=f1766269-5bdf-451c-9984-571ee745afa1" alt=""><figcaption><p>token.dev</p></figcaption></figure>

* And we can change the cookie by modifying the 2 marked fields in the payload
* Changing `admin` to `true` and `answer` to `yes`

<figure><img src="https://1613628666-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKkuxWaWwvkRd57ql1rtY%2Fuploads%2F91Bgee2FM8FrHBs5zU3c%2Fimage.png?alt=media&amp;token=3fe9ef38-0690-4c52-8358-31ca66861043" alt=""><figcaption></figcaption></figure>

* Replacing the cookie on the website and visiting `/sup3r_s3cr3t_d1r`, we get the flag

<figure><img src="https://1613628666-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKkuxWaWwvkRd57ql1rtY%2Fuploads%2Fim0FjENxuga0P0ZpAu0V%2Fimage.png?alt=media&amp;token=2bec464f-57b5-4270-aa36-2fcdd7f781a9" alt=""><figcaption><p>flag</p></figcaption></figure>

### FLAG

```
YCTF{3a1_c00k13s_t0_51ay_a1iv3}
```