PicoCTF 2025 on NullByte Notes

# cookie monster secret recipe

Fri, 05 Jun 2026 00:00:00 +0000

Description

Cookie Monster has hidden his top-secret cookie recipe somewhere on his website. As an aspiring cookie detective, your mission is to uncover this delectable secret. Can you outsmart Cookie Monster and find the hidden recipe? You can access the Cookie Monster here and good luck

solution

We should check for HTTP cookies.

Check the cookies
Start DevTools in the browser by pressing F12 or using Ctrl + Shift + I.
Then select the Application tab and make sure http://verbal-sleep.picoctf.net:56241 is selected under Cookies in the menu to the left.

# hashcrack

Fri, 05 Jun 2026 00:00:00 +0000

Description

A company stored a secret message on a server which got breached due to the admin using weakly hashed passwords. Can you gain access to the secret stored within the server? Access the server using nc verbal-sleep.picoctf.net 57819

solution

┌──(root㉿Harsh)-[/home/jhagan]
└─# nc verbal-sleep.picoctf.net 57819
Welcome!! Looking For the Secret?

We have identified a hash: 482c811da5d5b4bc6d497ffa98491e38
Enter the password for identified hash: password123
Correct! You've cracked the MD5 hash with no secret found!

Flag is yet to be revealed!! Crack this hash: b7a875fc1ea228b9061041b7cec4bd3c52ab3ce3
Enter the password for the identified hash: letmein
Correct! You've cracked the SHA-1 hash with no secret found!

Almost there!! Crack this hash: 916e8c4f79b25028c9e467f1eb8eee6d6bbdff965f9928310ad30a8d88697745
Enter the password for the identified hash: qwerty098
Correct! You've cracked the SHA-256 hash with a secret found.
The flag is: picoCTF{UseStr0nG_h@shEs_&PaSswDs!_869e658e}

crack the hashes by CrackStation

🔍 1. Length of the Hash

Each hashing algorithm produces a fixed-length output, typically in hexadecimal.

# heap-dump

Fri, 05 Jun 2026 00:00:00 +0000

🧩 Challenge Description

Explore a web application and find an endpoint that exposes a file containing a hidden flag. The application is a blog where one of the articles discusses API documentation. The goal is to find a file generated from the server’s memory that contains the flag.

A heap dump is a snapshot of a program’s memory (specifically, the heap section) at a particular point in time. It typically contains:

# SSTI1

Fri, 05 Jun 2026 00:00:00 +0000

Description:

I made a cool website where you can announce whatever you want! Try it out! I heard templating is a cool and modular way to build web apps! Check out my website here!

Hints:

Server Side Template Injection

Solution

Browse to the web site and you will see a web page that includes the text

Verify SSTI

The hint has already given away that the site uses server-side templates but we need to verify that and find out the backend technology used.