PicoCTF 2019 'Cookies' Challenge Solved by Enumerating HTTP Cookie Values

·1 views

A beginner-level web exploitation challenge on the PicoCTF 2019 platform tasked participants with finding a hidden flag on a cookie-themed website. The site assigned each cookie type a sequential numeric identifier stored in a client-side HTTP cookie named 'name', starting at 0 for the default 'snickerdoodle' option. By incrementing the cookie value from 0 to 18 — either manually through browser DevTools or via an automated Python script using the requests library — the flag was revealed at name=18. The vulnerability mirrors a real-world security flaw known as Insecure Direct Object Reference (IDOR), where the server blindly trusts a client-supplied value without server-side validation. The challenge highlights why sequential identifiers in cookies are a security red flag and underscores the importance of inspecting cookies whenever a site serves personalized content.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Perplexity Users Revolt as Paid AI Features Quietly Moved Behind Extra Paywalls

Perplexity AI subscribers have raised widespread complaints after several paid features were silently downgraded or locked behind additional credit-based paywalls during the third week of August 2025. The sharpest grievance centres on Comet, Perplexity's agentic browser, which was shifted to a separate 'Computer' credit meter, effectively removing a core feature that many users cited as their primary reason to subscribe. Users also reported the removal of model-usage labels, the ability to delete answers, and access to specific AI models such as Gemini, none of which were reflected in any change to the publicly listed pricing page. The recurring pattern described across Reddit threads is not a visible price increase but a quiet reduction in what an unchanged subscription actually delivers. Critics argue that routing previously included features through a secondary currency amounts to a hidden re-pricing of the product.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tool Maps Florida's 'Aid Deserts' by Joining FEMA, Census, and Doctor Data

A developer built 'Aid Desert Finder,' a tool that identifies Florida counties where disaster exposure, poverty, and healthcare scarcity converge but receive little donor attention. The project combines three federal datasets — FEMA disaster declarations, U.S. Census poverty estimates, and the national healthcare provider registry — into a single county-level ranking across all 67 Florida counties. The analysis found nine counties, home to roughly 258,000 people, that score highest on a composite need index averaging 22 disaster declarations over ten years, a one-in-five poverty rate, and below-median doctor density. A stark example highlighted is Glades County, which has far fewer doctors per capita than Alachua County despite comparable poverty levels, a disparity invisible when any single dataset is examined alone. The interactive choropleth map, built on Snowflake's free public data marketplace, shows rural interior and panhandle counties lighting up as the most underserved regions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Neural Networks Learn: Weights, Activations, and Backpropagation Explained

A technical breakdown of neural network fundamentals traces the architecture from the earliest single-layer perceptron, invented in 1943, through to modern multi-layer deep networks. The core mechanics involve weighted sums of inputs passed through non-linear activation functions such as ReLU, which allow networks to model complex, non-linear patterns in data. During training, a loss function measures the gap between predicted and actual outputs, and backpropagation calculates how much each weight contributed to that error. Gradient descent then nudges every weight incrementally in the direction that reduces the loss, repeating this loop across many training iterations. A practical PyTorch implementation is used to show how each theoretical concept — linear layers, activation, loss calculation, and weight updates — maps directly to working code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Hidden Pitfalls That Derail Zero-Downtime Cloud Migrations

Cloud migrations frequently promise zero downtime but often fail due to overlooked technical dependencies, according to a DevOps analysis published on DEV Community. Key problem areas include DNS TTL settings left at 24-hour intervals, which cause rolling outages during cutover if not reduced days in advance. Stateful components such as databases and session queues are typically planned last despite being the most complex to migrate, while hardcoded IPs and environment-specific credentials in CI/CD pipelines silently break the first post-migration deployment. Monitoring stacks tied to old internal networks are another common blind spot, leaving teams with empty dashboards during the first incident in the new environment. The article recommends starting migration planning with the stateful layer, parameterizing pipeline configs, running monitoring in parallel across both environments, and rehearsing rollback procedures in staging before migration day.

0 comments Read more at DEV Community