Crack the Gate11

Challenge Description

One of our persons of interest is believed to be hiding sensitive data inside a restricted web portal. We've uncovered the email address he uses to log in: ctf-player@picoctf.org. Unfortunately, we don't know the password, and the usual guessing techniques haven't worked. But something feels off: it's almost like the developer left a secret way in.

---

First Look

Opened the website and tried the provided email with a test password (1234). Login failed as expected: the challenge said guessing hadn't worked.

Before trying anything else, I opened DevTools (right-click → Inspect) and looked at the page source. Checking HTML source and comments is always the first step on web challenges: developers sometimes leave debugging notes, hints, or accidentally committed credentials in the markup.

In the page source I found this comment:

<!-- ABGR: Wnpx - grzcbenel olcnff: hfr urnqre "K-Qri-Npprff: lrf" -->

---

Decoding the Comment

The string ABGR: Wnpx didn't look like Base64: it had spaces and mixed case but no = padding. The word Wnpx looked like it could be a name. My instinct was some kind of substitution cipher.

I pasted it into CyberChef and tried ROT13 first: ROT13 is the most common simple cipher used in CTF hints because it's easy to implement accidentally (or intentionally) and shifts each letter by 13.

CyberChef output:

NOTE: Jack - temporary bypass: use header "X-Dev-Access: yes"

That decoded immediately. A developer named Jack had left a backdoor: sending a specific HTTP header X-Dev-Access: yes would bypass authentication.

---

Adding a Custom Header

I now needed to send a login request with an extra HTTP header that browsers don't send by default. You can't add custom headers through the browser's normal interface: you need a tool that lets you modify raw HTTP requests.

I had already used Burp Suite in my home lab so I knew what it could do. The workflow:

Step 1: Turn on Burp Proxy intercept

Opened Burp Suite → Proxy tab → turned Intercept ON. Configured Firefox to route traffic through Burp's proxy (127.0.0.1:8080).

Step 2: Trigger the login request

Went back to the challenge site, entered the email ctf-player@picoctf.org and any password, then clicked Login.

Burp intercepted the outgoing POST request before it reached the server and held it, showing me the raw HTTP:

POST /login HTTP/1.1
Host: [challenge-ip]
Content-Type: application/x-www-form-urlencoded

email=ctf-player%40picoctf.org&password=1234

Step 3: Send to Repeater and add the header

Right-clicked the intercepted request → Send to Repeater.

In the Repeater tab I could freely edit the request. I added the header from the decoded comment into the request headers section:

POST /login HTTP/1.1
Host: [challenge-ip]
Content-Type: application/x-www-form-urlencoded
X-Dev-Access: yes

email=ctf-player%40picoctf.org&password=1234

Clicked Send.

Step 4: Response

The server responded with a successful login. The response body contained the flag.

---

What This Vulnerability Is

Two separate issues combined to make this exploitable:

Issue 1: Sensitive information in HTML comments. The ROT13-encoded comment was visible to anyone who opened DevTools. Encoding something with ROT13 provides zero actual security: it takes about 10 seconds to decode. Developers should never put authentication bypass information in client-side code, encoded or not.

Issue 2: Header-based authentication bypass. The server was checking for X-Dev-Access: yes as a way to skip the normal login flow. This is a classic "temporary" developer shortcut that never got removed before deployment. In a real application, this would be a critical authentication bypass vulnerability: any attacker who discovered it could log into any account without credentials.

This kind of header-based bypass gets discovered in real applications through source code leaks, decompiled mobile apps, and: as demonstrated here: forgotten HTML comments.

---

What I Learned

This challenge introduced me to Burp Suite's Repeater tab for modifying individual HTTP requests. Before this I had used Burp mainly to intercept and forward traffic. Repeater is the tool for actually manipulating requests: changing headers, parameters, and methods to test how the server responds.

It also reinforced that HTML source inspection is always the first step on web challenges. The hint was right there in the page: finding it just required knowing to look.

---

Flag

picoCTF{brut4_f0rc4_125f752d}