# login

> My dog-sitter's brother made this website but I can't get in; can you help? [login.mars.picoctf.net](https://login.mars.picoctf.net)

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F3kaxSUiMiJahCQHMdRtS%2F1.png?alt=media&#x26;token=ce61c9fe-70c8-451c-a0ea-9fb7037850f6" alt=""><figcaption></figcaption></figure>

Let's input some credentials and check the `Developer Tools > Network` tab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FSBgP2gFNomZSQ380TfQE%2F4.png?alt=media&#x26;token=e862c9eb-5694-4ae7-a50f-3b05a09572ab" alt=""><figcaption></figcaption></figure>

We can see that the `Network` tab is empty. This means that no request is being sent to any server.

So the credential check must be happening on the client side. Let's check the source code of the site.&#x20;

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FgVFwrPLqnFlNq334kXXX%2F2.png?alt=media&#x26;token=3990b922-030a-4add-b5d1-b8e09073c12b" alt=""><figcaption></figcaption></figure>

We can see that there is an `index.js` file.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FYY5k3SANKU6Jjm5sWY1N%2F3.png?alt=media&#x26;token=2e8dde34-a79e-4335-a103-dcc554e029e9" alt=""><figcaption></figcaption></figure>

We can format the script using an online Javascript formatter.

## Script

```js
(async () => {
  await new Promise((e) => window.addEventListener("load", e)),
    document.querySelector("form").addEventListener("submit", (e) => {
      e.preventDefault();
      const r = {
          u: "input[name=username]",
          p: "input[name=password]",
        },
        t = {};
      for (const e in r)
        t[e] = btoa(document.querySelector(r[e]).value).replace(/=/g, "");
      return "YWRtaW4" !== t.u
        ? alert("Incorrect Username")
        : "cGljb0NURns1M3J2M3JfNTNydjNyXzUzcnYzcl81M3J2M3JfNTNydjNyfQ" !== t.p
        ? alert("Incorrect Password")
        : void alert(`Correct Password! Your flag is ${atob(t.p)}.`);
    });
})();
```

The script defines two objects `r` and `t`, which represent the username and password input fields.

The script then loops through the properties in the `r` object (username and password) and uses the `btoa` function to encode the values of the corresponding input fields. The `.replace(/=/g, "")` part removes the equal signs from the base64-encoded strings.

It then checks if the base64-encoded username (`t.u`) is equal to `YWRtaW4` and the base64-encoded password (`t.p`) is equal to `cGljb0NURns1M3J2M3JfNTNydj3NyfQ`.

If they match, it displays an alert with a success message, and if not, it displays an alert with an error message.

Let's use Cyberchef to decode the encoded password.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fi6vlzStgli58EYe84Ptw%2F5.png?alt=media&#x26;token=c905733b-d182-4f32-b341-6e5897582bca" alt=""><figcaption></figcaption></figure>

### Flag

```
picoCTF{53rv3r_53rv3r_53rv3r_53rv3r_53rv3r}
```
