Cookies

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-20 | Status: Solved Techniques: Comma-separated value formatting, HTTP Cookie header manipulation, Request parameter ordering

Summary

Task: Web page requires specific cookies with amounts. Solution: Send comma-separated values in Cookie header matching the required format.

Cookies — hackerlab.pro

Description

"Я не представляю свою жизнь без печений. Кстати, в одной пачке они хорошо смотрятся"

(Translation: "I can't imagine my life without cookies. By the way, they look good in one pack")

Target: http://62.173.140.174:16047/

Analysis

The web page displayed a message with required cookies:

• Sugar cookies = 1 amount
• Oatmeal cookies = 5 amounts
• Crackers cookies = 2 amounts

The key hint in the description — "в одной пачке" (in one pack) — indicated that all values should be combined/packed together. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Observations

1. Multiple values — need to pass several types of cookies with different amounts
2. "In one pack" format — values should be combined with commas
3. Order matters — cookies and amount must correspond to each other by position

Solution

The solution was to send HTTP cookies with comma-separated values:

 bash read-only • copy allowed Copy
curl -b "cookies=Sugar cookies,Oatmeal cookies,Crackers cookies; amount=1,5,2" \
     http://62.173.140.174:16047/

Request Structure

Cookie: cookies=Sugar cookies,Oatmeal cookies,Crackers cookies; amount=1,5,2

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Where:

• cookies — list of cookie types separated by commas
• amount — corresponding amounts separated by commas

Alternative Method (via browser)

In DevTools Console:

 javascript read-only • copy allowed Copy
document.cookie = "cookies=Sugar cookies,Oatmeal cookies,Crackers cookies";
document.cookie = "amount=1,5,2";
location.reload();

Lessons

1. Comma-separated cookies — non-standard but working way to pass multiple values
2. Hints in description — "in one pack" directly indicated the format
3. Order correspondence — positions in cookies and amount lists must match ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

References

• HTTP Cookies (MDN)
• curl -b option ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍