[CTF] root-me Challenges/Realist/The-h-ckers-l4b Write-up

[amogg]

Challenge URL

---

• https://www.root-me.org/en/Challenges/Realist/The-h-ckers-l4b

Clues

---

• log page
• csrf attack

Let's solve

---

find /log/

try to access /log/log.php

change http method for bypass auth

let's go admin login!
but, already logged in.

try csrf, disconnet admin.
using BBCode

success, disconnected admin.

login and aexploit menu, get the flag!