> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2021/web-exploitation/more-cookies.md).

# More Cookies

<figure><img src="/files/bgEt5TKVbJf2FaHFYzYC" alt=""><figcaption></figcaption></figure>

If we go to devtools and look at the cookies we see this cookie stored :&#x20;

eHgvZzFGYy83ZjNnbVphNlU1VVZUOVllV0xEQ1FHSUJwMWVqNHJNLzdsZXVmMWhqeGlpUHBySkJwdE0yNHh1UkpXL1FRNXJjc3FXVmZOeWkrdmdmL0VvUUQ1ZXpOZmI0Y20vVXRCMWpiaFc1WGswT0hJNEpJVXJBZFh3dVdUS3I=

<figure><img src="/files/HOLXZGeh0NruXTwtFjIs" alt=""><figcaption></figcaption></figure>

Decoding it does nothing, so we'll have to find something else.&#x20;

From the description of the challenge, we know it uses CBC and something involving with Homomorphic-Encryption.

### What is Homomorphic Encryption

Homomorphic encryption is a form of [encryption](https://en.wikipedia.org/wiki/Encryption) that allows computations to be performed on encrypted data without first having to decrypt it.[<sup>\[1\]</sup>](https://en.wikipedia.org/wiki/Homomorphic_encryption#cite_note-1) The resulting computations are left in an encrypted form which, when decrypted, result in an output that is identical to that of the operations performed on the unencrypted data. Homomorphic encryption can be used for privacy-preserving outsourced [storage](https://en.wikipedia.org/wiki/Cloud_storage) and [computation](https://en.wikipedia.org/wiki/Cloud_computing). This allows data to be encrypted and outsourced to commercial cloud environments for processing, all while encrypted

### What is CBC (Cipher Block Chaining)&#x20;

In CBC mode, each block of plaintext is XORed with the previous ciphertext block before being encrypted. This way, each ciphertext block depends on all plaintext blocks processed up to that point. Specifically, let's go deeper:&#x20;

{% embed url="<https://medium.com/@masjadaan/cbc-bit-flipping-attack-b92efafbb83d>" %}

### What is Block Ciphers Encryption

Data is encrypted one block at a time, with the block length varying across different algorithms. If the length of the data being encrypted is not a multiple of the block length, then padding becomes necessary

Several well-known algorithms use block ciphers, including:

* Advanced Encryption Standard (AES)
* Data Encryption Standard (DES)
* Triple Data Encryption Standard (3DES)
* Blowfish
* Twofish

However, there's modes to this.&#x20;

Since block ciphers operate on fixed-size blocks of data, challenges arise when dealing with plaintext data that exceeds the block length. Various modes of operation address this issue, allowing for the encryption and decryption of messages of different lengths. Some commonly used modes include:

* Electronic Codebook (ECB) Mode
* Cipher Block Chaining (CBC) Mode
* Counter (CTR) Mode

This leads to this CTF is a CBC Bit-Flipping attack. We need to basically bit-flip a value (likely if admin=0) to equal to 1.&#x20;