A comprehensive security CTF challenge for learning cookie vulnerabilities through hands-on exploitation
Cookie Security Lab is an educational platform designed for security professionals and students to practice identifying, exploiting, and mitigating cookie-related vulnerabilities. This lab provides 6 realistic vulnerabilities with hashed CTF flags, step-by-step walkthroughs, and secure pattern examples.
Perfect for:
- 🎓 Security training programs
- 🏆 CTF competitions
- 🔬 Penetration testing practice
- 📚 OWASP ASVS learning
- 🛡️ Web application security courses
- ✅ Cookie tampering for authorization bypass
- ✅ XSS and session theft via missing HttpOnly
- ✅ Over-broad cookie scope exploitation
- ✅ Session fixation attacks
- ✅ CSRF (Cross-Site Request Forgery)
- ✅ Cookie value poisoning
- ✅ Secure cookie patterns (HttpOnly, Secure, SameSite)
- ✅ Server-side session management
| # | Vulnerability | Flag | Difficulty |
|---|---|---|---|
| 1 | Client-Controlled Role Cookie | FLAG{CLIENT_CONTROLLED_ROLE_59721BC5} | ⭐ Easy |
| 2 | XSS Cookie Theft | FLAG{XSS_COOKIE_THEFT_5C6EA866} | ⭐⭐ Medium |
| 3 | Broad Scope Cookie | FLAG{BROAD_SCOPE_COOKIE_0DE7C8AB} | ⭐ Easy |
| 4 | Session Fixation | FLAG{SESSION_FIXATION_E3C79F1B} | ⭐⭐ Medium |
| 5 | CSRF Role Change | FLAG{CSRF_ROLE_CHANGE_3051E639} | ⭐⭐ Medium |
| 6 | Cookie Poisoning | FLAG{COOKIE_POISONING_252CD918} | ⭐⭐ Medium |
- Node.js ≥ 18 (Install)
- npm (comes with Node.js)
- Firefox or Chrome browser (recommended)
- Burp Suite Community (optional, for advanced exercises)
git clone https://github.com/yourusername/cookie-security-lab.git
cd cookie-security-labnpm installnpm startNavigate to: http://localhost:3004
| Document | Purpose |
|---|---|
| CTF-Walkthrough.md | Start here! Step-by-step flag collection guide |
| cookie-lab-guide.md | Detailed vulnerability explanations & OWASP mappings |
| cookie-lab-server.js | Well-commented vulnerable server code |
- Risk: Authorization bypass via cookie tampering
- Method: DevTools or Burp Suite
- Learning: Never trust client-side authorization
- Risk: JavaScript can steal session cookies; transmission over HTTP
- Method: XSS simulation & console
- Learning: HttpOnly is mandatory for session cookies
- Risk: Cookies sent with every request (images, stylesheets, etc.)
- Method: DevTools Network tab
- Learning: Use specific paths and domain restrictions
- Risk: Attacker forces known session ID on victim
- Method: URL parameter manipulation
- Learning: Generate session IDs server-side only
- Risk: Malicious form can change user settings
- Method: Form submission demo
- Learning: Implement CSRF tokens and SameSite
- Risk: Server accepts arbitrary cookie values
- Method: Query parameter injection
- Learning: Never trust cookie inputs
Each vulnerability includes a comparison with the secure pattern:
/secure/login— Server-side session with opaque ID/secure/admin— Authorization via server-side lookup- Proper flags:
HttpOnly,Secure,SameSite=Strict
- Backend: Express.js (Node.js)
- Cookie Parser: cookie-parser
- Crypto: Node.js built-in crypto module
- Frontend: HTML/CSS (educational landing page)
cookie-security-lab/
├── cookie-lab-server.js # Main vulnerable server
├── cookie-lab-guide.md # Comprehensive guide
├── CTF-Walkthrough.md # Step-by-step solutions
├── package.json # Dependencies
├── README.md # This file
├── LICENSE # MIT License
├── .gitignore # Git ignore rules
└── .github/
└── workflows/
└── verify.yml # CI/CD pipeline
✨ 6 Unique Vulnerabilities - Each teaches distinct security concepts 🎯 Hashed CTF Flags - Anti-guessing, cryptographically verified 📖 Detailed Walkthroughs - Step-by-step exploitation guides 🔒 Secure Patterns - Compare vulnerable vs. secure implementations 🏷️ OWASP ASVS Mapped - Links to security standards 💬 Code Comments - Educational explanations throughout 🧪 CI/CD Pipeline - Automated verification
- Follow the walkthrough: Open CTF-Walkthrough.md
- Exploit each vulnerability: Use provided methods (DevTools, Burp, etc.)
- Collect flags: Each exploit returns a unique hashed flag
- Document learning: Take notes on security lessons
- Compare secure patterns: Review
/secure/*endpoints
This project helps you learn:
- CTF (Capture The Flag)
- Cookie Security
- Web Vulnerabilities
- OWASP ASVS
- Session Management
- XSS (Cross-Site Scripting)
- CSRF (Cross-Site Request Forgery)
- Penetration Testing
- Security Training
- Vulnerable Code Examples
This lab intentionally contains security vulnerabilities for educational purposes.
- ❌ Do NOT deploy in production
- ❌ Do NOT use code patterns from this lab in real applications
- ✅ Study the vulnerabilities and security lessons
- ✅ Always implement secure patterns from
/secure/*examples
When completing this lab, document:
- Vulnerability Name - What was exploited?
- Root Cause - Why was it vulnerable?
- Exploitation Method - How did you exploit it?
- Flag - What did you collect?
- Mitigation - How would you fix it?
- OWASP ID - Reference standard
- OWASP ASVS v4.0 — Session Management (V3) & Access Control (V4)
- PortSwigger Web Academy — Cookie & Session labs
- RFC 6265bis — Cookie specification
- OWASP Testing Guide — Session testing
- Use Developer Tools - F12 in Firefox/Chrome, especially Application tab
- Monitor Network Traffic - Watch cookie headers in real-time
- Use Burp Suite - Repeater tab is excellent for testing variations
- Read Console Logs - Server prints helpful debugging info
- Compare Secure Code -
/secure/*shows proper patterns - Document Everything - Take screenshots of each flag
Found an issue or have suggestions?
- Open an issue on GitHub
- Submit a pull request with improvements
- Suggest new vulnerabilities to demonstrate
This project is licensed under the MIT License - see LICENSE file for details.
- Built for security education and OWASP awareness
- Inspired by real-world cookie vulnerabilities
- References: PortSwigger, OWASP, RFC 6265bis
- 📖 Read CTF-Walkthrough.md for step-by-step help
- 📚 See cookie-lab-guide.md for detailed explanations
- 🔧 Check server logs for debugging info
- ❓ Review code comments for implementation details
Happy learning! 🎓 Collect all 6 flags and master cookie security! 🚩