The cookie that is trusted too much
FitNova, the gym with the members app, decides who you are by looking at a cookie. You are an ordinary member: can you get into the place only staff can enter? Prove that a regular member can become an admin and retrieve the flag.
Lab 2 of 7 in the Web Exploitation path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 40 and 120 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Find out which cookie the site sends (headers) (100 XP)
- Enter the members area with your cookie (100 XP)
- Get turned away by the staff panel (100 XP)
- Enter the staff panel (150 XP)
Topics: web, cookie, owasp-a01.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
curl: makes HTTP requests from the terminal and shows the server’s raw answer, headers included.
The simulated environment
The target is an invented host on a simulated private network: you can only reach it from the game terminal.
The target exposes these services:
- SSH: encrypted remote command-line access; it is protected with keys instead of passwords and without direct root login.
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
The server decided permissions by reading a value that comes from the client, and the client is controlled by whoever uses it: a cookie can be changed in a second with curl or the browser developer tools. It is a classic of OWASP A01 (Broken Access Control). Defensive lesson: never trust data the user can change. The cookie should hold only a random session identifier (or a token signed by the server); the role is read on the server, from the session, on every request.
Before and after this lab
To unlock it you must have solved:
- robots.txt and forgotten folders (Web Exploitation, easy)
After this lab you can move on to:
- Aurora — Web Breach (Web Exploitation, medium)
- Clues in the page code (Web Exploitation, medium)
The Web Exploitation path
Web Exploitation brings the basics into the world of websites and web applications, where a huge share of real attacks happen. You explore invented sites with HTTP requests from the terminal and discover folders someone hoped to hide, cookies the server trusts too much, factory credentials never changed, comments forgotten in the page source and error messages that say too much. The lessons follow the OWASP Top 10 categories, such as Broken Access Control and authentication failures, and each one explains the fix.