> For the complete documentation index, see [llms.txt](https://heapbytes.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/web-security/cookie.md).

# Cookie

Challenge link: https\://cookiechallenge.pythonanywhere.com/

<figure><img src="https://2093681522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8U5ZBZXak4T44Qt4GjMG%2Fuploads%2FvK4IXhhbWJXOcc2EZ5C4%2Fimage.png?alt=media&amp;token=0c3f8fae-2014-4e44-8bf9-067452c3393d" alt=""><figcaption><p>chall desc &#x26; points</p></figcaption></figure>

## homepage

<figure><img src="https://2093681522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8U5ZBZXak4T44Qt4GjMG%2Fuploads%2FUshL5TkWHDozu0bndPP2%2Fimage.png?alt=media&amp;token=51a95562-bf24-40fa-849e-2d8a01da4758" alt=""><figcaption></figcaption></figure>

* i fuzzed the url&#x20;
* got 2 directory

<figure><img src="https://2093681522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8U5ZBZXak4T44Qt4GjMG%2Fuploads%2F8qjDgPkG6kxfooIl9mWf%2Fimage.png?alt=media&amp;token=1c1a27c5-ac8d-4670-8d8a-4a2d4e989613" alt=""><figcaption></figcaption></figure>

* the /robots.txt page had a directory for us : `/sup3r_s3cr3t_d1r`

<figure><img src="https://2093681522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8U5ZBZXak4T44Qt4GjMG%2Fuploads%2F8GfdWUibOzZTXnFdK6Vs%2Fimage.png?alt=media&amp;token=2f48f6e5-3561-40a8-b190-dfad4087fcf9" alt=""><figcaption></figcaption></figure>

* after visiting `/cookie` we get a jwt cookie

<figure><img src="https://2093681522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8U5ZBZXak4T44Qt4GjMG%2Fuploads%2Fmo69kEd1rfmlZQFDfz6Q%2Fimage.png?alt=media&amp;token=60ceb21f-b51f-4cb3-8ca6-95ecc0acf0f9" alt=""><figcaption></figcaption></figure>

* how cookie looks like&#x20;

<figure><img src="https://2093681522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8U5ZBZXak4T44Qt4GjMG%2Fuploads%2FbwvidsQ8T2j1vPcCGmti%2Fimage.png?alt=media&amp;token=cc01f937-e7a8-44dd-9b66-7ddbf9286601" alt=""><figcaption></figcaption></figure>

* we need to change values marked in red&#x20;

<figure><img src="https://2093681522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8U5ZBZXak4T44Qt4GjMG%2Fuploads%2FpscBHrpXDES7dtUQ7RzA%2Fimage.png?alt=media&amp;token=b1f14af7-c52c-4104-a4ca-bef1b488864f" alt=""><figcaption><p>forged token</p></figcaption></figure>

* now update the cookie & visit `/sup3r_s3cr3t_d1r`

<figure><img src="https://2093681522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8U5ZBZXak4T44Qt4GjMG%2Fuploads%2FyUcGZdpwTUklgw6vxIBc%2Fimage.png?alt=media&amp;token=2b4f73ec-b404-420d-8cbd-0dcf428e3c8a" alt=""><figcaption></figcaption></figure>

## Flag :&#x20;