darkly/weak_cookie_auth/README.md

# Weak auth via cookie

## How We Found It
On all the pages, if we have no cookies, the website gives us a cookie. the cookie is called `i_am_admin` and has this value : 
```
68934a3e9455fa72420237eb05902327
```
That look like a md5 hash. what if I decrypt it.  
this is a hash of `false`.   
what if I hash `true` and set it as the cookie.  
when I do this. on all pages, there is an alert that gives me the flag

## Utility of It
- Allows an attacker to forge an admin session by reverse-engineering or guessing cookie values.
- No need to log in or brute-force credentials — just manipulate a hash.
- Can lead to privilege escalation, access to admin features, or flag retrieval in CTFs.

## How Can We Patch It
- Never rely on easily reversible or guessable values (like md5("true")) for auth.
- Use secure session tokens, randomly generated and validated server-side.
- Store roles (like admin/user) in a server-side session — not in a modifiable cookie.
- Avoid using MD5 for any security-related checks; it's outdated and weak.
- Sign cookies with a HMAC or encrypt them if you must store data client-side.