Loading
You are practising on the demo portal of Kirana Mart, a fictional shop at portal.example.com. In the browser's developer tools you copy this Set-Cookie header. The session value looks encoded, twice over.
The header is below, inside the code block. First, URL-decode the session value. Percent signs followed by two characters are just encoded characters. The Researcher Toolkit has a URL decoder.
What you get is a small JSON object. Find the token inside it. That token is Base64-encoded, so decode it with the Toolkit's Base64 decoder.
The result is the inside of a flag. Wrap it in the flag format: the letters M X C, an opening curly brace, your decoded text, and a closing curly brace. Then paste it into the Submit box.
Real cookies often hide encoded data like this. Never trust a cookie just because it looks scrambled.
Set-Cookie: session=%7B%22user%22%3A%22guest%22%2C%22token%22%3A%22Y29va2llc19hcmVfbm90X3NlY3JldF80OHQ0%22%7D; Path=/; Domain=portal.example.com; HttpOnly
This challenge only. All names, addresses and data are fictional. Do not test any real system.
Stuck? Open hints in order: a nudge, then the next step, then an explicit pointer. Costs are taken from this solve's points.
Sign in to open hints.
Sign in to submit a flag.
Sign in, then solve this challenge or give up on it to read write-ups.