BroncoCTF: Lovely Login

Short summary

A BroncoCTF writeup for the 'Lovely Login' challenge. The expected NoSQL injection attack path was a dead end due to server-side type checking. The actual vulnerability was an unprotected /security page disclosed in robots.txt that revealed passwords are derived by reversing usernames, combined with a base64-encoded username list also hidden in robots.txt. The flag was obtained by logging in as admin with the reversed password.

• •NoSQL operator injection ruled out — both fields type-checked server-side
• •robots.txt disclosed /security page revealing password = reversed username
• •Base64 comment in robots.txt provided valid username list including admin

Generated with AI, which can make mistakes.