Login Problems

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: client_side_auth_bypass, client_side_secret_extraction, javascript_deobfuscation

Summary

Walkthrough of the CUSTOM Web Login Problems. Task: a Flask/Werkzeug login page hides its authentication logic in a JSFuck-obfuscated frontend script. Solution: deobfuscate /static/hell.js, recover the hardcoded admin credentials, and log in as a

Description

Проблемы с логином

English summary: the target is a small login page at http://62.173.140.174:16008. Recon showed Werkzeug/2.3.4 on Python/3.10.4, and the real goal was to become admin by inspecting the frontend logic.

Analysis

The homepage only exposed a login form, so the next useful artifact was /static/hell.js.

That file was JSFuck-obfuscated JavaScript. After deobfuscation, it became clear that the application performed the credential check entirely in the browser instead of on the server. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The critical values were hardcoded in the script:

 javascript read-only • copy allowed Copy
login == "admin@admin.admin"
password == "CODEBY{REDACTED}"

This means there was no real server-side authentication barrier. The secret was directly recoverable from client-side code.

Solution

1. Open the login page.
2. Inspect the referenced script /static/hell.js.
3. Deobfuscate the JSFuck payload.
4. Read the embedded credential check.
5. Log in with:
   • Login: admin@admin.admin
   • Password: CODEBY{REDACTED}

Minimal helper script: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3

TARGET = "http://62.173.140.174:16008"
LOGIN = "admin@admin.admin"
PASSWORD = "CODEBY{REDACTED}"

print(f"Target: {TARGET}")
print(f"Recovered login: {LOGIN}")
print(f"Recovered password: {PASSWORD}")
print("Use these credentials in the browser to authenticate as admin.")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering client_side_auth_bypass, client_side_secret_extraction, javascript_deobfuscation was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2025-12-24 • CUSTOM • Login Problems • Difficulty: Easy