Category: Web exploitation
Points: 100
Author: Yahaya Meddy
We’re in the middle of an investigation. One of our persons of interest, ctf player, is believed to be hiding sensitive data inside a restricted web portal. We’ve uncovered the email address he uses to log in: ctf-player@picoctf.org. Unfortunately, we don’t know the password, and the usual guessing techniques haven’t worked. But something feels off... it’s almost like the developer left a secret way in. Can you figure it out?
Additional details will be available after launching your challenge instance.
1: Developers sometimes leave notes in the code; but not always in plain text.
2: A common trick is to rotate each letter by 13 positions in the alphabet.
For this chall, we have access to a web application to which we must log in. There are no options to create an account so we'll have to find credentials one way or another.
By checking the source code of the page with Ctrl+U, we come across this:
Clue number 2 makes us understand that the message in front of us is encoded in rot-13.
Let’s decode it:
According to this message, we can use the X-Dev-Access:yes header which is a backdoor left by the devs. To do this we can use BurpSuite or ZAP. In this article, BurpSuite will be used.
After intercepting and adding the X-Dev-Access:yes header to the request + any password, we get the flag.
GG!