# CopyPasta

> Our favorite code sharing platform is back with the hint ***BAC***

After my usual playing around and clicking all the buttons, I went to BurpSuite and noticed that the session was organized by a cookie rather than a JWT. Interesting...

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2F7rQOGS7gBTc3p9a6deBd%2Fimage.png?alt=media&#x26;token=a7e42b20-bdc8-4e3d-988e-94a6f2cf110f" alt=""><figcaption></figcaption></figure>

That `%3D` caught my eye, that's a `=`, could this be an URL encoded, Base64 string?

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2Fx0UfQtMJ3xLR7wsQNqAc%2Fimage.png?alt=media&#x26;token=ce7b7887-0734-460f-94d3-879315c777ba" alt=""><figcaption></figcaption></figure>

Well yes it does! And the Base64 decoded string looks like a md5-hash to me.&#x20;

With `hashcat -m 0 3bf1114a986ba87ed28fc1b5884fc2f8 rockyou.txt -d 1` I could  crack the hash.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FBhlba99YwkTgQomHSJxn%2Fimage.png?alt=media&#x26;token=811b3e18-ea34-46ec-8363-fef980e25c24" alt=""><figcaption></figcaption></figure>

Well look at that, the hash is just my username!

So I went to CyberChef and tried something out.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FHeeT8WP03g4UEyjyQWkH%2Fimage.png?alt=media&#x26;token=15fa795b-8c44-49aa-b3e6-9f5289454e5a" alt=""><figcaption></figcaption></figure>

That output should be the token of the admin right?

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FtuVvAbOGRBy8Yz1LeaAP%2Fimage.png?alt=media&#x26;token=ba94fb01-aa91-4896-b353-04cc3548b287" alt=""><figcaption></figcaption></figure>

Yes, that is the token of the admin! Flag secured! 🇧🇪
