Old Sessions

Web Recon

The standard entry point of the application is a login/registration page.

After creating a new account and authenticating, we inspected the page and discovered a suspicious comment pointing to a directory: /sessions..

Vulnerability Discovery: Insecure Session Management

By navigating to the /sessions endpoint, we found a list of active session tokens. Among these entries, we identified a high-value cookie belonging to the Administrator.

Exploitation (Session Hijacking)

To escalate our privileges and access the admin account, we followed these steps:

1. Intercept/Edit: Opened the browser’s Developer Tools (F12) and navigated to the Application or Storage tab.
2. Replace: Replaced our current session cookie with the stolen Administrator cookie.
3. Refresh: Reloaded the page to authenticate as the admin.

the server validated the hijacked session, granting us access to the administrative dashboard where the flag was displayed.