PicoCTF: Crack the Gate 1 (Web Exploitation)

A web portal is protected by a login form. You already know the email ctf-player@picoctf.org but not the password. My first, very uncreative move was to try that email with a random password. I typed random charactersinto the pasword field and hit login.

The page replied with “invalid credentials.” Not surprising. I thought for a second: maybe there’s a weak password, or maybe the hint is hidden somewhere on the page. So I did the thing every beginner and 90% of experienced CTF players do next, I looked at the page source.

Scrolling through the HTML, most of it was boilerplate, but a tiny comment caught my eye. It wasn’t English, it looked like scrambled letters:

<!-- ABGR: Wnpx - grzcbenel olcnff: hfr urnqre "K-Qri-Npprff: lrf" -->
<!-- Remove before pushing to production! --> 

My brain pinged: “That looks like ROT13.” ROT13 is a simple letter substitution that shifts letters by 13 places, it’s common in puzzles and lazy obfuscation. It’s also the kind of thing developers might use to hide a quick note without meaning real security.

I copied the garbled text into CyberChef and ran a ROT13 operation. It immediately translated to plain English:

NOTE: Jack - temporary bypass: use header "X-Dev-Access: yes"

A dev backdoor. Classic. The note told me the developer had left a temporary bypass: if the login request includes the header X-Dev-Access: yes, the server would allow access regardless of password.

Method A: Using cURL

I wanted to reproduce the bypass without relying on the browser (browsers block a lot of custom headers because of CORS), so I used curl first, quick and reliable.

• Right click on the page
• Click inspect
• Navigateto Network
• Click Login button on the page
• Back to inspector, Right click on the request made

• Copy then copy cURL

• Open your terminal and paste it then add the vulnerability hint header you decoded

-H 'X-Dev-Access: yes' \

The response printed out, and there it was a JSON blob with the flag. I copied the picoCTF{...} string and jumped to the scoreboard to submit it.

Method B: Using BurpSuite

If you prefer a GUI and visual verification, Burp Suite is perfect. Here’s how I did it in Burp:

1. Open Burp → Proxy → Intercept: ON.
2. In the browser, submit the login form with ctf-player@picoctf.org and any password. Burp catches the POST.
3. In the intercepted request, Add in the headers section:

X-Dev-Access: yes

4. Forward the request (or send it to Repeater).

5. The server responded with the flag in the response body.

A tiny note on how I knew to try ROT13: the scrambled text had short groups and letter patterns (ABGR, Wnpx) that are typical of ROT13-encoded English (for example, ABGR decodes to NOTE under ROT13). ROT13 is one of those “first things to try” decoders for suspicious-looking comments.

Takeaway (what this challenge teaches)

• Always check the page source: developers sometimes leave notes or debug helpers.
• ROT13 is a tiny but common obfuscation, try it when you see “garbled” alphabetic text.
• Custom headers are a common dev-backdoor pattern. You can use tools like curl, Postman, or Burp Suite to send arbitrary headers and reproduce behavior that browsers block.