Point: 100
Web-Exploitation
Can you break into this super secure portal? https://jupiter.challenges.picoctf.org/problem/17682/ or http://jupiter.challenges.picoctf.org:17682
Never trust the client
The main objective of this challenge is to illustrate never to implement any password checking functions on the client side (browsers).
The web portal given prompts the user for a valid credential for verification to proceed to next step. After snooping around the web page, a javascript function called verify() is discovered where the flag is broken in to 8 different parts for checking valid credential.
The catch here is, the if statements are not in order for checking different parts of the flag. Simply need to understand what the code is doing and follow the number sequence from the code to get the flag in correct order.
Here is a useful resource to find out what javascript substring() function does by w3schools. https://www.w3schools.com/jsref/jsref_substring.asp
None