sessionChallenge.html

{% extends "base.html" %}

{% block navTabs %}
{% include "helpers/sessionNav.html" %}
{% endblock navTabs %}



{% block content %}
<h1>Session Challenge</h1>

<p>As HTTP is stateless we need some way of storing state.
  Here we will look at some (un)common approaches that people might use</p>

<p>In this challenge we store state through session cookies</p>
<p>Flask stores the session cookies client side.  This means that we need some way of ensuring they are secure.
  To do this the cookies are encoded, with a checksum. </p>

<div class="section">
  <h3>Challenge</h3>
  <p>Client side cookie approach has some advantages. However, it relies on a the secret key being truly secret.</p>
  
  <p>In Flask, if we can leak the key in some way, then we could use it to add our own
    data to the session cookie.</p>
  
  <p>The secret key for this app is <strong class="red-text">{{ secretKey }}</strong></br>
    use it to set the admin flag in the session cookie to get the flag</p>
</div>


<div class="section">
  <h2>Login Form</h2>
  <form method="POST">
    <div class="row">
      <div class="input-field col s12">
	<input id="user" name="user" type="text">
	<label for="user">User Name</label>
      </div>
    </div>
    <input type="hidden" name="admin" value=0></input>
     <button class="btn waves-effect waves-light" type="submit" name="action">Submit</button>
  </form>
</div>



{% if uName %}
<div class="section">
  <div class="card blue-grey darken-1">
    <div class="card-content white-text">
      <span class="card-title">Result</span>
      
      <p>Loggged in as <strong>{{ uName }}</strong></p>
      {% if admin == "True" %}
      <p><strong>Admin:</strong> Have a Flag: 245CT{Enc0ded_S3ssion_Keys}</p>
      {% else %}
      <p>Not Admin</p>
      {% endif %}
      <p>You have made {{ attempts }} requests </p>
    </div>
  </div>

</div>
{% endif %}


{% endblock content %}