Tags: web
Rating:
# Challenge Name: All about resetting
## Description
Who can guess my password or.. http://all-about-resetting.ctf2021.hackpack.club
## Detailed solution
Start by opening challenge link http://all-about-resetting.ctf2021.hackpack.club
It's a login page
Let's check the page source view-source:https://all-about-resetting.ctf2021.hackpack.club/
```html
<html lang="en">
<head>
<title>Login V1</title>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
</head>
<body>
<span>
Member Login
</span>
<div>
<input placeholder="Email">
</input>
</div>
<div>
<input placeholder="Password">
</input>
</div>
<div class="container-login100-form-btn">
<button class="login100-form-btn">
Login
</button>
</div>
<form action="/reset" method="post">
<button type="submit" value="Send Email" >Forgot Password?</button>
</form>
</body>
</html>
```
We have only the Forget passowrd? option with a POST request to /reset
at https://all-about-resetting.ctf2021.hackpack.club/reset we can see a POST request to /rest2 using the email from input
```html
<form action = "/reset2" method = "POST">
<h3>Enter user email to RESET</h3>
<input type = 'text' name = 'email' placeholder="Email"/>
<input type = 'submit' value = 'Login'/>
I tried with a random email but i got nothing
Checking the response headers i found a set-cookie header with a flask cookie
```
set-cookie: session=.eJyrVkpLzMyJT84rUbIy1AFyyvKLMktS0_PLUovyEvOSU5WslLITszOLS_KTixKTK5UQakpSE3OBsvk5lbkFmYnJ-cVKtQBcuByb.YH3Pcg.XajTlQMYBDBUBL5sG7nPoo1o908; HttpOnly; Path=/
```
Let's use flask-unsign to decod the cookie https://pypi.org/project/flask-unsign/
```
flask-unsign --decode --cookie .eJyrVkpLzMyJT84rUbIy1AFyyvKLMktS0_PLUovyEvOSU5WslLITszOLS_KTixKTK5UQakpSE3OBsvk5lbkFmYnJ-cVKtQBcuByb.YH3Pcg.XajTlQMYBDBUBL5sG7nPoo1o908
{'fail_cnt': 1, 'favoritegovernance': 'kakistocracy', 'favoriteteam': 'olympiacos'}
```
We have two values :
- favoritegovernance : kakistocracy
- favoriteteam : olympiacos
Back to our home page we found a coomen tag with an email
```html
```
I used the email [email protected] with the reset feature
The answer is **kakistocracy** we go it from decoding the flask cookie
We got our flag
## Flag
```
flag = flag{Wh4t_1s_th1s_gov3rn4nc3_!!!}
```
