> For the complete documentation index, see [llms.txt](https://kunalwalavalkar.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kunalwalavalkar.gitbook.io/write-ups/picoctf/web-exploitation/cookies.md). # Cookies > Who doesn't love cookies? Try to figure out the best one.

Let's proxy the traffic through Burpsuite and provide `snickerdoodle` as the input.

We can see that the application redirects us to `/check`. Now let's send the request that is sent to `/check` to the `Intruder`.

Then we can configure the payload position to be the cookie. Next we have to craft the payloads.

The payload type is a `Simple list` with numbers from 1 to 20. Let's start the attack and sort the responses by their length in ascending order.

We can see that the response with the shortest length is the one with the cookie set to 18. That is also same the response in which the flag is present. ## Flag ``` picoCTF{3v3ry1_l0v3s_c00k135_88acab36} ```