# Cookies > Who doesn't love cookies? Try to figure out the best one.

Let's proxy the traffic through Burpsuite and provide `snickerdoodle` as the input.

We can see that the application redirects us to `/check`. Now let's send the request that is sent to `/check` to the `Intruder`.

Then we can configure the payload position to be the cookie. Next we have to craft the payloads.

The payload type is a `Simple list` with numbers from 1 to 20. Let's start the attack and sort the responses by their length in ascending order.

We can see that the response with the shortest length is the one with the cookie set to 18. That is also same the response in which the flag is present. ## Flag ``` picoCTF{3v3ry1_l0v3s_c00k135_88acab36} ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://kunalwalavalkar.gitbook.io/write-ups/picoctf/web-exploitation/cookies.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.