CTF TOPIC · 9 FLAGS · 22 MIN

Web inspection

View source, cookies, hidden fields, robots.txt, IDOR and reading a JWT.

Web challenges reward looking at what the browser already has. View the page source for comments; read and edit cookies, which live on the client; find hidden and disabled form fields that the server may still trust; check robots.txt for paths the site wanted hidden; try changing an id in a URL (IDOR); and decode a JWT, whose payload is readable because it is signed, not encrypted. The theme: never trust the client.

A first example

Ctrl+U for source ; document.cookie ; /robots.txt ; /receipt?id=1002

First moves

1. View the page source and read every comment
2. Open developer tools: cookies, storage, network tab
3. Check /robots.txt and obvious backup paths
4. Read client-side JavaScript checks
5. On a practice target: change ids in URLs and inspect the result

The challenges

• Behind the page · Easy · 20 XP
• A crawler’s clue · Easy · 20 XP
• The body is a distraction · Medium · 30 XP
• Hidden in the source · Easy · 20 XP
• Check the cookie · Easy · 20 XP
• Disabled on the client · Easy · 20 XP
• Change the number · Medium · 30 XP
• Read the token · Medium · 30 XP
• The sitemap knows · Easy · 20 XP