Category: Web exploitation
Points: 200
Author: Yahaya Meddy
The login system has been upgraded with a basic rate-limiting mechanism that locks out repeated failed attempts from the same source. We’ve received a tip that the system might still trust user-controlled headers. Your objective is to bypass the rate-limiting restriction and log in using the known email address: ctf-player@picoctf.org and uncover the hidden secret.
Additional details will be available after launching your challenge instance.
1: What IP does the server think you’re coming from?
2: Read more about X-forwarded-For
3: You can rotate fake IPs to bypass rate limits.
For this chall, we have access to a web application to which we must log in. There are no options to create an account so we'll have to find credentials one way or another. After launching the chall instance, we obtain a wordlist. We immediately understand that it will be necessary to "brute force" the password associated with the ctf-player@picoctf.org account.
Let's try entering the wrong password several times to learn more about the rate limit mentioned in the third clue.
After the second attempt, we receive this message:
The second clue suggests we learn more about X-forwarded-For.
It's basically a header that takes the value of the IP of the machine sending the request.
We assume that the rate limit is based on this header. We can therefore falsify our IP in order to send more requests. To do this we can use BurpSuite or ZAP. In this article, BurpSuite will be used.
Intruder will be used with mode: Pitchfork attack. Why ? This mode uses several lists in parallel.
For this chall, the value of X-forwarded-For does not need to be exactly an IP. We can just settle for a number.
Summary:
- We'll use Pitchfork mode for Intruder.
- We'll add an
X-Forwarded-Forheader; its payloads will be of typeNumbers. - We'll use the wordlist provided by the challenge in the
passwordfield.
After launching the attack, we find the flag.
GG!