Skip to main content
  1. CTF Writeups/
  2. KOSS CTF 2025/

Hokago Tea Time

·
Web 166pt Cookie
subzcuber
Author
subzcuber
i like to imagine i’m funny

Flag: kossCTF{mugi_chan_is_veryyy_rich}

Author: subzcuber

Description:

Can you figure out the favourite snack of our K-On girls?


It was a crazy experience seeing so many people play K-On songs in a large Nalanda classroom. Thank you everyone.

From the webpage and the description you were supposed to figure out that their favourite snack is “Cookies”. This is a sign to go look at the cookies with your browser tools.

You should see this “sus” cookie

sus cookie

The value it stores is

a29zc0NURnttdWdpX2NoYW5faXNfdmVyeXl5X3JpY2h9==

The “==” is a dead giveaway that this is base64 encoded. So let’s decode that

echo -n "a29zc0NURnttdWdpX2NoYW5faXNfdmVyeXl5X3JpY2h9" | base64 -d
kossCTF{mugi_chan_is_veryyy_rich}

You could also just go into the script.js and see the line that set the cookie.

document.cookie = "sus=a29zc0NURnttdWdpX2NoYW5faXNfdmVyeXl5X3JpY2h9==; path=/;";
Reply by Email

Related

Invisibility Cloak
Web 50pt
super simple web intro
Password Manager
Web 50pt Path Traversal
path traversal is blocked, or is it?
Artventures
Web Flask Cookie Spoofing
flask cookie spoofing