📊 Challenge Overview

Category	Details	Additional Info
🏆 Event	picoGym	Event Link
🔰 Category	Web	🌐
💎 Points		Out of 500 total
⭐ Difficulty	🟡 Medium	Personal Rating: 1/10
👤 Author	Geoffrey Njogu	Profile
🎮 Solves (At the time of flag submission)	20.563	solve rate
📅 Date	10-02-2025	picoGym
🦾 Solved By	mH4ck3r0n3	Team:

📝 Challenge Information

Help us test the form by submiting the username as test and password as test!

🎯 Challenge Files & Infrastructure

Provided Files

1	Files: None

🔍 Initial Analysis

First Steps

Initially, the website appears as follows:

With a login screen. As suggested by the page description, I tried entering user=test and password=test, but I got the following screen:

So I tried entering user=test and password=test!, as suggested by the screen, and managed to log in:

Inspecting the page, there was nothing, but looking at the url field in the browser at the moment of login, I noticed two redirects, so I decided to inspect the request. Let’s move on to exploitation.

🎯 Solution Path

Exploitation Steps

Initial setup

To analyze the request, I did not use BurpSuite since it was just two redirects. I enabled the Keep Log checkbox in the Network section of ChromeDevTools, which retains all request logs.

Exploitation

As we can see, by logging in again and inspecting the Network section, I managed to intercept the two redirects:

From here, I noticed a parameter id containing a strange base64 string, so I decided to decode it:

1	echo cGljb0NURntwcm94aWVzX2Fs | base64 -d

Finding the first part of the flag. Next, I decoded the second one:

1	echo bF90aGVfd2F5XzNkOWUzNjk3fQ== | base64 -d

Recovering the second part of the flag. I then concatenated them and decoded once more:

1	echo;echo cGljb0NURntwcm94aWVzX2FsbF90aGVfd2F5XzNkOWUzNjk3fQ== | base64 -d

Printing the full flag.

Flag capture

🛠️ Exploitation Process

Approach

The automatic exploit performs the login request and extracts the redirect link from the header, obtaining the first part of the flag. Then, it makes a GET request to the URL formed by site URL + redirect URL from the header, extracts the second URL containing the second part of the flag using a regex, decodes it from base64, and prints it.

•  Exploit

🚩 Flag Capture

Flag

Proof of Execution

Screenshot of successful exploitation

🔧 Tools Used

Tool	Purpose
Python	Exploit
ChromeDevTools	Web Testing

💡 Key Learnings

Skills Improved

• Binary Exploitation
• Reverse Engineering
• Web Exploitation
• Cryptography
• Forensics
• OSINT
• Miscellaneous

📊 Final Statistics

Created: 10-02-2025 • Last Modified: 10-02-2025 *Author: mH4ck3r0n3 • Team: *