Hello Everyone!
I’m Tareq from Knight Squad.
Recently we played RCTS CERT CTF 2021. Here I’m going to give you a quick writeup for the challenge named “Exclusive Access”. Let’s dig into it.
In the challenge section we were provided with a link. After visiting the link it showed me 403 Access Denied. Admin Only.
After that I checked the cookie & found something interesting. There was a user_type variable with some preassigned value & it was URL encoded.
Than I browsed to CyebrChef & decoded it from following.
>> First Url Decode
>> Second Base64 Decode
After that I got the pain text. It was “guest”. So I thought I have to change the cookie variable user_type value to admin with URL encode. I just did it. I encoded “admin” to the following:
>> First Base64 encode
>> Second URL Encode
Than I assigned the encoded text to the user_type in the cookie & reloaded the page. And finally I got the flag.
