Cookies picoCTF 2021 Solution

Description

1. Step 1Observe the name cookie

   Observation

   Visiting the site sets a cookie named 'name' holding a plain, unsigned integer. That integer is being used directly as a database lookup key, with no authentication or signature protecting it.

   When you visit the site, it sets a cookie named 'name' with an integer value (starting at 0). The server maps this integer to different items in its database. You need to find which integer value corresponds to the flag entry by iterating through values.

   Learn more

   HTTP cookies are key-value pairs stored in the browser and sent with every request to the server. The server uses the Set-Cookie response header to set them, and the browser sends them back in the Cookie request header. Here, the cookie value is a plain integer with no signing or encryption - making it trivially forgeable.

2. Step 2Brute-force the cookie value

   Observation

   The cookie carries no signature and no session binding. So iterating through integer values with curl and grepping the response body for 'picoCTF{' finds the flag, with no authentication bypass required.

   Iterate the cookie value with curl and grep for the picoCTF prefix. 0-100 covers most CTF-scale databases; bump to 0-1000 if nothing hits.

   bash

   # Sweep 0-100, print only matches:

   Copied!

   bash

   for i in $(seq 0 100); do flag=$(curl -s -b "name=$i" http://<server>/check | grep -oE 'picoCTF\{[^}]*\}'); [ -n "$flag" ] && echo "id=$i $flag"; done

   Copied!

   bash

   # If nothing matches, widen the range:

   Copied!

   bash

   for i in $(seq 0 1000); do flag=$(curl -s -b "name=$i" http://<server>/check | grep -oE 'picoCTF\{[^}]*\}'); [ -n "$flag" ] && echo "id=$i $flag" && break; done

   Copied!

   Expected output

   id=18 picoCTF{3v3ry1_l0v3s_c00k135_...}

   What didn't work first

   Tried: Trying to manipulate the cookie name or value as a string (e.g. 'admin', 'flag', 'true') instead of iterating integers.

   The server ignores anything that does not parse as an integer index, returning the same default page with no error and no flag. The cookie is a numeric database row ID, so only integers map to real entries. Enumerate sequentially from 0.

   Tried: Sending requests without the cookie header at all, or checking the page response status code to detect the flag.

   Every request returns HTTP 200 whether the cookie is present or not, so status codes tell you nothing, and without the cookie the server serves the same default page every time. The only reliable signal is 'picoCTF{' appearing in the response body, so grep the output rather than checking the exit code.

   Learn more

   Why 0-100 first. Most CTF web apps seed their cookie database with a tiny ordered set of items - the flag entry typically lives in the first hundred IDs because the challenge is designed to be solved in seconds, not hours. Widen to 0-1000 only if the small sweep produces nothing.

   Detect success on the response, not the status code. A 200 response is not a success signal here - every integer returns 200. The signal is whether the page body contains the flag prefix. Piping through grep -oE 'picoCTF{[^}]*}' isolates the flag string and skips noisy IDs.

   This is an insecure direct object reference (IDOR)-style vulnerability combined with an unauthenticated enumeration attack. The server stores the flag at a specific ID in its cookie database and retrieves it based solely on the client-supplied cookie value, with no authentication check. The fix: never trust client-supplied identifiers alone for authorization; pair them with server-side session validation. For more on cookie-related bug shapes, see cookies and JWTs in CTF.

Flag

The server maps integer cookie values to items in a database - brute-forcing the integer reveals which value corresponds to the flag entry.