> For the complete documentation index, see [llms.txt](https://heapbytes.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/web-security/cookie.md).

# Cookie

<figure><img src="/files/YUVqXyraaoFUeLAV1IGx" alt=""><figcaption><p>chall desc &#x26; points</p></figcaption></figure>

## homepage

<figure><img src="/files/WsWEfR7VsFRMISIHgrML" alt=""><figcaption></figcaption></figure>

* i fuzzed the url&#x20;
* got 2 directory

<figure><img src="/files/dEdJyNNUslHUJtDHwCKW" alt=""><figcaption></figcaption></figure>

* the /robots.txt page had a directory for us : `/sup3r_s3cr3t_d1r`

<figure><img src="/files/GpQCA8MMPrayv4CByqKD" alt=""><figcaption></figcaption></figure>

* after visiting `/cookie` we get a jwt cookie

<figure><img src="/files/QEEEO4DWKP1H0P3bjfUm" alt=""><figcaption></figcaption></figure>

* how cookie looks like&#x20;

<figure><img src="/files/wknvzGjYLk7E6ByvDSsO" alt=""><figcaption></figcaption></figure>

* we need to change values marked in red&#x20;

<figure><img src="/files/0JOCnqNhZp0Nt7N6Khls" alt=""><figcaption><p>forged token</p></figcaption></figure>

* now update the cookie & visit `/sup3r_s3cr3t_d1r`

<figure><img src="/files/jOFpwlQPkHBWTajIhQJg" alt=""><figcaption></figcaption></figure>

## Flag :&#x20;