Dev Backdoor

Vulnerability Overview

A hardcoded authentication bypass was left in production HTML source code, obfuscated with ROT13 — a trivially reversible substitution cipher that provides no meaningful protection. Any user who viewed the page source could recover the bypass mechanism and authenticate without valid credentials.

Reconnaissance

The challenge description hinted at a developer mistake. Rather than interacting with the login form, the first action was viewing the page source with Ctrl+U. Buried in the HTML was a commented-out line encoded in ROT13:

<!-- ABGR: Wnpx - grzcbenel olcnff: hfr urnqre "K-Qri-Npprff: lrf" -->
<!-- Remove before pushing to production! -->

The second comment — "Remove before pushing to production!" — confirmed this was debug code that was never cleaned up.

Decoding the Backdoor

ROT13 decoding of the comment revealed:

NOTE: Jack - temporary bypass: use header "X-Dev-Access: yes"

A custom HTTP header was all that was needed to bypass authentication entirely — no password required.

Exploitation

Using a browser Header Editor extension, the header X-Dev-Access: yes was added to all outgoing requests. Submitting the login form with the known email ctf-player@picoctf.org and any arbitrary password authenticated successfully, granting access to the restricted portal and the flag.

Root Cause

Debug code was committed and deployed to production without review. The ROT13 obfuscation was cosmetic — it added no computational barrier, only the false assumption that users wouldn't look at source. HTML source code is entirely public; obfuscation of secrets stored there is never a substitute for removal.