PicoCTF 2025

Description Cookie Monster has hidden his top-secret cookie recipe somewhere on his website. As an aspiring cookie detective, your mission is to uncover this delectable secret. Can you outsmart Cookie Monster and find the hidden recipe? You can access the Cookie Monster here and good luck solution We should check for HTTP cookies. Check the cookies Start DevTools in the browser by pressing F12 or using Ctrl + Shift + I. Then select the Application tab and make sure http://verbal-sleep.picoctf.net:56241 is selected under Cookies in the menu to the left. ...

Description A company stored a secret message on a server which got breached due to the admin using weakly hashed passwords. Can you gain access to the secret stored within the server? Access the server using nc verbal-sleep.picoctf.net 57819 solution ┌──(root㉿Harsh)-[/home/jhagan] └─# nc verbal-sleep.picoctf.net 57819 Welcome!! Looking For the Secret? We have identified a hash: 482c811da5d5b4bc6d497ffa98491e38 Enter the password for identified hash: password123 Correct! You've cracked the MD5 hash with no secret found! Flag is yet to be revealed!! Crack this hash: b7a875fc1ea228b9061041b7cec4bd3c52ab3ce3 Enter the password for the identified hash: letmein Correct! You've cracked the SHA-1 hash with no secret found! Almost there!! Crack this hash: 916e8c4f79b25028c9e467f1eb8eee6d6bbdff965f9928310ad30a8d88697745 Enter the password for the identified hash: qwerty098 Correct! You've cracked the SHA-256 hash with a secret found. The flag is: picoCTF{UseStr0nG_h@shEs_&PaSswDs!_869e658e} crack the hashes by CrackStation 🔍 1. Length of the Hash Each hashing algorithm produces a fixed-length output, typically in hexadecimal. ...

🧩 Challenge Description Explore a web application and find an endpoint that exposes a file containing a hidden flag. The application is a blog where one of the articles discusses API documentation. The goal is to find a file generated from the server’s memory that contains the flag. A heap dump is a snapshot of a program’s memory (specifically, the heap section) at a particular point in time. It typically contains: ...

Description: I made a cool website where you can announce whatever you want! Try it out! I heard templating is a cool and modular way to build web apps! Check out my website here! Hints: Server Side Template Injection Solution Browse to the web site and you will see a web page that includes the text Verify SSTI The hint has already given away that the site uses server-side templates but we need to verify that and find out the backend technology used. ...