Solving Oreo from csictf CTF 2020

The Oreo challenge from csictf CTF 2020 had following note and web address.

1
2
3

My nephew is a fussy eater and is only willing to eat chocolate oreo. Any other flavor and he throws a tantrum.

http://chall.csivit.com:30243

The challenge page had following text displayed on the main page.

As usual the first stop for these kind of CTFs are to check source code and to see if there is any juicy information. In this case there wasn't any hence I decided to check request and response from the application. I started intercepting request via burp suite and noticed one strange cookie named flavor which is being sent to the server.

The value assigned to this cookie was base64 encoded c3RyYXdiZXJyeQ%3D%3D. I decoded this value and it gave strawberreQ. Since author's nephew likes chocolate, I decided to encode the word chocolate using base64 encoding and append that value in flavor cookie and forward the request. Upon doing so I was presented with the flag and thus the challenge was completed.

Thanks for reading!!!