Htb academy - broken authentication - brute forcing cookie

HTB Content Academy
1

Hello friends.
I have problem with the first question in this module.

Tamper the session cookie for the application at subdirectory /question1/ to give yourself access as a super user. What is the flag?

I found the incoding methods and the plaintext of the cookie.

I changed the role to admin, administrator, teacher, nt authority, super user, teacher, manager and nany more but still get the message that the role x dont have flag.

I tried all these rules with htbuser and htbadmin with no successes.

I even tried brute forcing the time stamp but still no success…

The second qustion took me 5 minutes.

Anyone can help me with a hint?
Anybody solved this question?

Thank you

2 Likes
2

The question is written in a very confusing way. The cookie of the user “super” is searched for

12 Likes
3

Thank you my friend.
It worked.
I still find it strange to set the role as super.
I think this was by mistake but thanks a lot.

5

Just got it. The role of the user we are looking for is ‘super’

1 Like