picoCTF — Hashgate (Web Exploitation)

1. What is this challenge? (What is this Challenge?) This is a Broken Access Control or Privilege Escalation based challenge. In simple terms, here you will log in as a normal user (Guest), but your goal is to access the system’s admin (Admin) profile and collect the ‘Flag’ from there.
2. What can you learn from this? (Learning Outcomes) Broken Access Control: How a website makes a mistake in checking user permissions.

Hardcoded Credentials: The risk of leaving passwords or secret keys in the source code.

Hashing (MD5): How to recognize if an ID or sensitive data is in hash form.

Brute Force with Burp Suite: How to check security by sending hundreds of requests using automated tools.

1. Step-by-Step Solution Step 1: Source Code Analysis (Finding Credentials) First, the site has a login page without any username or password. We check the browser’s View Source. There, we see that the developer has accidentally hardcoded an email and password.

Email and Password: We log in using the credentials found in the source code.

Step 2: User Profile Observation (Identifying the Vulnerability) After logging in, we see that our access level is ‘Guest’ and the user ID is 3000. We are told that only ‘Top Tier’ or admin users can see the flag.

We notice that our ID is not directly as 3000 in the browser’s URL or request, but rather it is as a long string (Hash).

Step 3: Identifying the Hash (Identifying MD5 Hash) We copy that long string of ID and check it with the Hash Identifier tool. The tool confirms that it is an MD5 Hash. That is, the server is verifying each user’s ID by MD5 hashing it.

Step 4: Brute Force Attack (Brute Force using Burp Suite) Since we don’t know the admin ID, we start the brute force using the Intruder tool of Burp Suite.

Payload Type: Numbers (we check numbers from 1 to 20,000).

Payload Processing: A trick is used here. Since the server doesn’t just understand numbers, it understands hashes, we tell Burp to MD5 hash each number before sending it.

Step 5: Capturing the Flag During the attack, we search for the text “picoCTF” in the ‘Responses’.

Whenever the server gives a correct response for a specific ID (admin ID) and the flag is found there, the challenge is completed.