PicoCTF Writeup
Old Sessions | PicoCTF Challenge Writeup
Exploiting Improper Session Management to Gain Unauthorized Access
Category: Web Exploitation
Difficulty: Easy
Description
Proper session timeout controls are critical for securing user accounts. If a user logs in on a public or shared computer but doesn’t explicitly log out (instead simply closing the browser tab), and session expiration dates are misconfigured, the session may remain active indefinitely.
This then allows an attacker using the same browser later to access the user’s account without needing credentials, exploiting the fact that sessions never expire and remain authenticated.
Your friend tells you to check out a new social media platform he built a few years ago. Although its still under development, he said the site is almost complete. He also mentioned that he hates constantly logging into sites, and so has made his page that ‘once you login, you never have to log-out again’!
Browse here, and find the flag!
Objective
The objective is to identify and exploit improper session management by verifying whether user sessions remain active indefinitely after login, allowing unauthorized access without re-authentication, and retrieving the flag.
Hints
- Hint 1: Do you know how to use the web inspector?
- Hint 2: Where are cookies stored?
Walkthrough
After launching the instance, I visited the web page.
First, I registered a new user on the site,
Get Debmalya Mondal’s stories in your inbox
Join Medium for free to get updates from this writer.
Username: dev
Password: anything
After registering, I logged into the site.
There, I found a comment mentioning that there was a strange site in the /sessions directory. So I navigated to it.
Here, I found the cookies of logged‑in users; the first one belongs to the admin, and the second one corresponds to my session.
Then, I used Burp Suite to intercept the homepage request and forwarded it to Repeater:
I modified the session cookie in the request and replaced it with the admin’s session cookie.
After modifying the session cookie, I sent the request to the server and received a 200 OK response. In the response tab, I switched to the Render view, where I successfully obtained the flag.
FLAG: picoCTF{***_*******_***********_********}
