Hidden Admin Content

Task description

Ana couldn’t find a site secure enough to keep her data on, so she built one where you have to be an administrator to see everything. She found a way to log in without any sign-in form or database.

The original was in Croatian; this is my translation.

A login with no login

The description gives it away before the page even loads. There’s no sign-in form and no database, yet the site still decides whether you’re an admin. That value has to be stored somewhere, and the only place left is a cookie.

A cookie is a small piece of text the server asks your browser to keep and send back on every visit. Sites use cookies to remember who you are between page loads. The catch is that the cookie lives in your browser, so you can read it and change it.

Finding the cookie

Open the developer tools (right-click, Inspect) and go to the Application tab in Chrome, or Storage in Firefox. Under Cookies we found one named account with the value guest.

So the site works out your access from that single word. It trusts the cookie as-is.

Changing it

Double-click the value, change guest to admin, and reload the flag page. It treats you as an administrator and shows the flag.

The lesson is that a cookie is under the visitor’s control, so the server can’t trust it to prove anything. Real sites store a long random session token in the cookie and keep the “is this person an admin” decision on the server, where the visitor can’t reach it.