Cookie Monster has hidden his top-secret cookie recipe somewhere on his website. As an aspiring cookie detective, your mission is to uncover this delectable secret. Can you outsmart Cookie Monster and find the hidden recipe? You can access the Cookie Monster here and good luck
🎯 Challenge Files & Infrastructure
Provided Files
1
Files:None
🔍 Initial Analysis
First Steps
Initially, the website appears as follows:
Site Presentation
On the login screen, when trying to enter username=admin&password=admin, you are redirected to a page where it says that credentials are not needed, only the cookies are required. So, I immediately decided to inspect them:
Login
As we can see, they appear to be base64 encoded.
🎯 Solution Path
Exploitation Steps
Exploitation
I immediately tried to decode it using bash (even though there were two URL-encoded characters %3D, it should work the same, and they can be removed or replaced with =):
The automated exploit performs exactly the steps done manually: it sends a POST request to the /login.php page and then extracts the cookies and decodes them.
