Cookies and Session IDs

This web server puts the flag in a cookie. Find it! Run /challenge/server, then interact with http://challenge.localhost/.

This challenge scrambles the flag before putting it in a cookie, using the same random XOR key for every flag byte. Recover the flag!

Run /challenge/server, then interact with http://challenge.localhost/.

A cookie can carry progress through a sequence of requests. If your client forgets that cookie, the next request loses the state needed to continue.

Follow this application's trail of GET parameters while keeping its cookies, and collect the flag cookie at the end. Run /challenge/server, then interact with it at http://challenge.localhost/.

Instead of storing all state in a cookie, a server can store that state itself and give the client a session ID that identifies it. The client returns the ID with later requests so the server can locate the same session. Therefore, protecting the (opaque) session ID is important.

Get a session ID from this server and return it in a cookie to receive the flag. Run /challenge/server, then interact with http://challenge.localhost/.

Encrypting a cookie hides its content, but secrecy alone does not make the original content trustworthy. AES CTR (counter mode) encrypts by XORing plaintext with a keystream. A change to a ciphertext bit causes the corresponding plaintext bit to change on decryption. Without authentication, the server cannot detect the manipulated cookie content.

This application encrypts a JSON cookie containing is_admin: false with AES-CTR and trusts the decrypted value. Gain admin access and find the flag! Run /challenge/server, then interact with http://challenge.localhost/.

This challenge stores web sessions in files. Quite luckily, this challenge also exposes a session inspector over HTTP. Use it to read the admin's session and recover the flag. Run /challenge/server, then interact with http://challenge.localhost/.

Predict the admin's session ID, inspect that session, and recover the flag. Run /challenge/server, then interact with http://challenge.localhost/.