If you’re learning web security or preparing for CTF competitions, this is a great beginner-friendly challenge to understand how HTTP cookies work and how they can be manipulated. HTTP cookies This challenge is from picoCTF and is called “Power Cookie.” picoCTF “Power Cookie.” Step 1: Understanding the Website Step 1: Understanding the Website We are given a very simple website. It looks like an online grade book system. online grade book system There are only two pages: two pages The home pagecheck.php The home page check.php When we click “Continue as Guest”, we are redirected to: “Continue as Guest” And we see this message: “We have no guest services at the moment.” “We have no guest services at the moment.” That’s interesting. Why mention the guest specifically? guest Step 2: Think About the Challenge Name Step 2: Think About the Challenge Name The challenge name is: Power Cookie Power Cookie Power Cookie Whenever a CTF challenge includes a keyword like cookie, it usually means: cookie 👉 We need to inspect or manipulate HTTP cookies. HTTP cookies Cookies are small pieces of data stored in the browser. They are often used to: Track sessionsStore login statesStore user roles (admin or guest) Track sessions Store login states Store user roles (admin or guest) Step 3: Inspecting the Cookie in the Browser Step 3: Inspecting the Cookie in the Browser Here’s what we do: Here’s what we do: Right-click on the webpageClick InspectGo to the Storage tab (or Application tab in some browsers)Click CookiesSelect the website domain Right-click on the webpage Click Inspect Inspect Go to the Storage tab (or Application tab in some browsers) Storage Click Cookies Cookies Select the website domain Now we see something interesting 👀 We find a cookie: Name: isAdmin Value: 0 Step 4: Understanding the Cookie Step 4: Understanding the Cookie The cookie is: isAdmin = 0 isAdmin = 0 This looks like a boolean value: 0 = False1 = True 0 = False 1 = True isAdmin = False isAdmin = False isAdmin = False Which means we are not an admin. That explains why we see: “We have no guest services at the moment.” “We have no guest services at the moment.” Step 5: Modifying the Cookie in the Browser Step 5: Modifying the Cookie in the Browser Now comes the important part. If we change: isAdmin = 0 to isAdmin = 1 isAdmin = 0 to isAdmin That means: isAdmin = True Now refresh the page. 🎉 BOOM! We see the flag! Why? Why? Because the website trusts the cookie value without verifying it properly on the server. This is a cookie-based privilege escalation vulnerability. cookie-based privilege escalation vulnerability — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — Solving It Using the Terminal (curl Method) Solving It Using the Terminal (curl Method) We can also solve this using the terminal. Step 1: Try accessing the page: curl http://example.com/check.php Step 1: Try accessing the page: http://example.com/check.php It shows: “Continue as guest” “Continue as guest” That’s because curl does not automatically send browser cookies. Step 2: Manually Adding the Cookie Step 2: Manually Adding the Cookie We can manually send a cookie using: It shows: “We have no guest services at the moment.” “We have no guest services at the moment.” Now change it to: isAdmin=1 isAdmin=1 🔥 And now we get the flag! Why This Works (Security Explanation) Why This Works (Security Explanation) The website is: Trusting client-side dataNot validating admin privileges on the serverUsing a simple Boolean cookie for authentication Trusting client-side data Not validating admin privileges on the server Using a simple Boolean cookie for authentication This is insecure because: 👉 Users can modify cookies easily Users can modify cookies easily A secure website should: Validate admin roles on the serverNot rely on client-side cookies for authorizationUse secure session tokens. Validate admin roles on the server Not rely on client-side cookies for authorization Use secure session tokens.

Walkthroughs, tutorials, guides, and tips. This story will teach you how to do something new or how to do something better.

CTF Walkthrough: Exploiting Cookie-Based Privilege Escalation in Power Cookie

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Blockchain Investigations in NTerminal - Powered by Splunk & CipherTrace

Capturing all the flags in BSidesSF CTF by pwning our infrastructure

Good Samaritan - The New Ethernaut CTF Challenge

Here's How I Organized a Jeopardy Style Capture-The-Flag Competition

How We used Docker to Organize a CTF like Event

One Website, 28 Flags: A Christmas Scavenger Hunt!

Blockchain Investigations in NTerminal - Powered by Splunk & CipherTrace

Capturing all the flags in BSidesSF CTF by pwning our infrastructure

Good Samaritan - The New Ethernaut CTF Challenge

Here's How I Organized a Jeopardy Style Capture-The-Flag Competition

How We used Docker to Organize a CTF like Event

One Website, 28 Flags: A Christmas Scavenger Hunt!

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps