ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Trust Me, I'm a Cookie

Easy 20 pts

A membership site keeps your session state in a cookie. It looks like gibberish, so the developer assumed it was safe to trust. It is base64 — reversible by anyone, no key required. Decode it and read what the server believes about you; the flag is in there.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

The session cookie value is base64. Decode it — CyberChef, base64 -d, or any decoder.

Hint 2

It decodes to a small JSON object describing your account.

Hint 3

One field is a note the developer left in. That note is the flag.

The artifact

Response setting the session, captured at login:

HTTP/1.1 200 OK
Set-Cookie: session=eyJ1IjoiZ3Vlc3QiLCJyb2xlIjoidXNlciIsIm5vdGUiOiJubXtuZXZlcl90cnVzdF90aGVfY2xpZW50X3NpZGVfc3RhdGV9In0=; Path=/; HttpOnly
Content-Type: text/html

Welcome back.

The whole cookie value is one base64 string — decode it.

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.