> For the complete documentation index, see [llms.txt](https://kunalwalavalkar.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kunalwalavalkar.gitbook.io/write-ups/picoctf/web-exploitation/dont-use-client-side.md).

# dont-use-client-side

> Can you break into this super secure portal? `https://jupiter.challenges.picoctf.org/problem/17682/` ([link](https://jupiter.challenges.picoctf.org/problem/17682/)) or <http://jupiter.challenges.picoctf.org:17682>

{% hint style="info" %}

1. Never trust the client
   {% endhint %}

<figure><img src="/files/BvhNNOHfk55hj5q1fycA" alt=""><figcaption></figcaption></figure>

Let's check how secure this portal really is.

<figure><img src="/files/bA7SHCrrdBBWcPLWYTln" alt=""><figcaption></figcaption></figure>

Unfortunately the credentials are checked on the Client side which allows us to reverse engineer the password.

## Script

```js
function verify() {
    checkpass = document.getElementById("pass").value;
    split = 4;
    if (checkpass.substring(0, split) == 'pico') {
      if (checkpass.substring(split*6, split*7) == '706c') {
        if (checkpass.substring(split, split*2) == 'CTF{') {
         if (checkpass.substring(split*4, split*5) == 'ts_p') {
          if (checkpass.substring(split*3, split*4) == 'lien') {
            if (checkpass.substring(split*5, split*6) == 'lz_b') {
              if (checkpass.substring(split*2, split*3) == 'no_c') {
                if (checkpass.substring(split*7, split*8) == '5}') {
                  alert("Password Verified")
                  }
                }
              }
      
            }
          }
        }
      }
    }
    else {
      alert("Incorrect password");
    }
}
```

It gets the value of an HTML element with the ID "pass" and stores it in the variable `checkpass`.

It then defines a variable `split` with a value of 4.

It checks the `checkpass` string against several conditions using `substring` to extract specific parts of the string.

All we have to do is arrange the split password.

## Flag

```
picoCTF{no_clients_plz_b706c5}
```