Local Authority — picoCTF

Fuad Hasan

3 min readSep 5, 2026

Challenge link:

https://learn.cylabacademy.org/library/278?page=1&workspace=true

Description:

Can you get the flag?

Get Fuad Hasan’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Let’s Drive to Find the Flag ->

Step-01:

Start the machine and go to the web page. The web page looks like this.

Step-02:

Try logging in with any username and password. Before trying, open the Network tab and enter for login. After finishing this process, see in the Network tab any suspicious file load; the filename is secure.js.

Step-03:

Now open this secure.js file and see the admin credentials. So collect this and try to log in with this; grep the FLAG.

Final step:

After successful login, see the target Flag.

Root Cause

The vulnerability stems from client-side authentication and hardcoded credentials:

Exposure of Secrets: Sensitive credentials are hardcoded in plaintext inside secure.js. Because JavaScript running in the browser executes on the client machine, any user can inspect the script via DevTools (Network or Sources tab) and retrieve them directly.
Flawed Security Model: Authentication logic is delegated to the front end rather than being verified securely on the server. Never rely on the client to enforce trust, perform authentication checks, or gate protected resources.

Remediation & Fix

To secure this authentication workflow:

Move Authentication to the Backend: The client should submit credentials over an encrypted channel via a POST request to a backend endpoint.
Store Password Hashes Securely: Never store or evaluate passwords in plaintext. Store salted password hashes using strong algorithms.
Issue Server-Side Sessions or Tokens: Upon successful verification on the server, create a secure, server-managed session or a signed JWT to authorize subsequent requests to protected pages.

PHP Example:

// login.php (Server-side validation)
session_start();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';

    // Fetch user hash from a database securely using prepared statements
    $stmt = $pdo->prepare('SELECT id, password_hash FROM users WHERE username = :username');
    $stmt->execute(['username' => $username]);
    $user = $stmt->fetch();

    if ($user && password_verify($password, $user['password_hash'])) {
        // Regenerate session ID to prevent session fixation
        session_regenerate_id(true);
        $_SESSION['user_id'] = $user['id'];
        header('Location: /admin.php');
        exit;
    }

    $error = "Invalid credentials.";
}