# Countdown
writeup by [5225225](https://www.5snb.club) for [BLÅHAJ](https://blahaj.awoo.systems)
**Web****455 points****63 solves**
> This challenge is simple. All you have to do is wait for the countdown to end to get the flag.> The countdown ends one second before the end of the CTF, but you have fast fingers right?
## writeup
You're sent to a website that contains a javascript countdown to a date. Above that is the phrase"Time is key.". Looking at the source code, it reads a cookie that contains 3 base64 parts joinedby dots, and only makes use of the first part. Decoding the first part of the cookie gives you aJSON object describing the date the page counts down to, but changing it doesn't get the server toreturn the flag.
The format was similar to that of a JSON Web Token, but it couldn't be a JWT.
Intentionally making the server return a 404 by going to a non-existent page gave us
> # Not Found>> The requested URL was not found on the server. If you entered the URL manually please check your> spelling and try again.
Looking online for that string, most of the results mention Flask(<https://github.com/pallets/flask>), a Python web framework. So the server's probably using flask.
Searches online leads us to itsdangerous (<https://itsdangerous.palletsprojects.com/en/1.1.x/>),which is the library Flask uses to sign its cookies. The format looks to match, so we know it's aFlask cookie.
To break it, I used flask-unsign (<https://github.com/Paradoxis/Flask-Unsign>), which is a toolthat can take a Flask cookie and crack the code using a wordlist. The built-in wordlist didn'tcrack the cookie, but then I went back and read the page, and tried both "time" and "Time" as thesecret key. "Time" turned out to be the key, so I could then re-sign the cookie with a date in thepast, paste that into my browser, and refresh the page, showing the flag.