The Most Secure Password Check

Task description

Ivan always wanted to know the best way to check whether a typed password is correct. After a lot of research he found a way to do it, so he came up with a strong password and built a page to test his idea.

The original was in Croatian; this is my translation.

The page

The link opens a plain form: one password box and a submit button. Type anything wrong and it rejects you. Type the right password and, going by the task, it sends you to the flag.

Where the check happens

A web page is made of two parts. The server is the computer that stores the site and sends it to you. The browser is the program on your own machine that displays it. Any HTML and JavaScript (the code that makes a page interactive) is sent to your browser and runs there, which means you can read all of it.

Right-click the button and choose Inspect to open the developer tools, the panel every browser has for looking at a page. In the HTML we found a small script attached to the button. Reading it showed what it does: it takes whatever you type, runs it through a hash, and compares that to a fixed value written into the script. A hash is a scrambled fingerprint of some text. If the two match, the script sends the browser to a page called flag_712301349fd.html.

That filename is the whole task. The check runs in your browser, so the page already knows where the flag lives before you type anything.

Two ways in

With the filename in hand, just visit /flag_712301349fd.html directly. The flag is printed on it.

You could also recover the password, by pasting the hash into an online hash-cracking site, but there’s no need. The flag’s address was in the page from the start.

This is why real sites never check passwords in the browser. The server has to do it, because anything sent to the browser is open to the visitor. Here, the “most secure” check gave the answer away.