Level 17 - 100 Cookies Challenge

Platform: kslweb1 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-08 | Status: Solved Techniques: anticheat_evasion, cookie_header_manipulation, raw_http_crafting

Summary

Task: Web challenge with anticheat proxy blocking automated tools, requiring 100 cookies in raw HTTP format. Solution: Bypass anticheat by sending HTTP request lines one at a time with delays using netcat, construct Cookie header with 100 semicolon-separated name=value pairs.

Level 17 - 100 Cookies Challenge — KSL Web 1

Description

A web challenge requiring understanding of raw HTTP protocol and cookie transmission. The task is protected by an anticheat proxy that blocks automated tools, requiring manual HTTP request crafting.

Analysis

1. Anticheat Proxy: Direct access returns 403 Forbidden, redirecting to port 58080. The proxy detects automated tools (curl, wget) by checking if the entire HTTP request is sent at once.
2. Cookie Requirement: The server requires at least 100 different cookies to be sent in a single request.
3. Raw HTTP Knowledge: Understanding that cookies are sent as semicolon-separated name=value pairs in a single Cookie: header line. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key observations:

• Server: nginx/1.18.0 (Ubuntu)
• PHP version: 5.5.9-1ubuntu4.21
• Trailing slash required on URL path (otherwise 301 redirect)

Solution

Step 1: Bypass Anticheat Proxy

The anticheat proxy requires sending HTTP request lines one at a time with delays between them. This proves the request is being crafted manually, not by automated tools.

 bash read-only • copy allowed Copy
# Test basic access through anticheat
(echo -ne "GET /second/level17/ HTTP/1.1\r\n"; sleep 0.5; \
 echo -ne "Host: kslweb1.spb.ctf.su\r\n"; sleep 0.5; \
 echo -ne "Connection: close\r\n"; sleep 0.5; \
 echo -ne "\r\n") | nc kslweb1.spb.ctf.su 58080

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Response reveals the actual challenge:

Nope, you should send a request with at least 100 different cookies
Current number of cookies: 0

Step 2: Generate 100 Cookies

Build a cookie string with 100 unique cookies in raw HTTP format:

 bash read-only • copy allowed Copy
# Generate 100 cookies
COOKIES=""
for i in $(seq 1 100); do
  if [ $i -eq 1 ]; then
    COOKIES="cookie${i}=value${i}"
  else
    COOKIES="${COOKIES}; cookie${i}=value${i}"
  fi
done

Step 3: Send Request with Cookies

Send the complete request with all 100 cookies through the anticheat proxy: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
(echo -ne "GET /second/level17/ HTTP/1.1\r\n"; sleep 0.5; \
 echo -ne "Host: kslweb1.spb.ctf.su\r\n"; sleep 0.5; \
 echo -ne "Cookie: ${COOKIES}\r\n"; sleep 0.5; \
 echo -ne "Connection: close\r\n"; sleep 0.5; \
 echo -ne "\r\n") | nc kslweb1.spb.ctf.su 58080

Complete Solve Script

 bash read-only • copy allowed Copy
#!/bin/bash
# Solve script for kslweb1 level17

HOST="kslweb1.spb.ctf.su"
PORT=58080
PATH_URL="/second/level17/"

# Generate 100 cookies
COOKIES=""
for i in $(seq 1 100); do
  if [ $i -eq 1 ]; then
    COOKIES="cookie${i}=value${i}"
  else
    COOKIES="${COOKIES}; cookie${i}=value${i}"
  fi
done
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Send request line-by-line to bypass anticheat
(
  echo -ne "GET ${PATH_URL} HTTP/1.1\r\n"
  sleep 0.5
  echo -ne "Host: ${HOST}\r\n"
  sleep 0.5
  echo -ne "Cookie: ${COOKIES}\r\n"
  sleep 0.5
  echo -ne "Connection: close\r\n"
  sleep 0.5
  echo -ne "\r\n"
) | nc ${HOST} ${PORT}

Lessons Learned

1. Raw HTTP Cookie Format: Multiple cookies are sent in a single Cookie: header, separated by ; (semicolon + space)
2. Anticheat Bypass: Some CTF platforms use timing-based anticheat that detects if requests are sent all at once (automated) vs line-by-line (manual)
3. Netcat for HTTP: When curl/wget are blocked, netcat allows full control over HTTP request timing and formatting
4. URL Trailing Slash: Some servers require trailing slashes; without them, you get 301 redirects that may break the flow ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍