PatriotCTF 2024 Impersonate Writeup

Here's my writeup for the PatriotCTF 2024 Impersonate challenge. Challenge notes Impersonate 476 Medium One may not be the one they claim to be. http://chal.competitivecyber.club:9999/ Author: _jungbahadurrana Files The challenge comes with a single app.py file that you can download from this address: https://pctf.competitivecyber.club/files/d5927c5731503b610ddc8e4410507f2b/app.py?token=… Abbreviated contents: from flask import Flask, request, render_template, jsonify, abort, redirect, session import uuid import os from datetime import datetime, timedelta import hashlib app = Flask(__name__) server_start_time = datetime.now() server_start_str = server_start_time.strftime('%Y%m%d%H%M%S') secure_key = hashlib.sha256(f'secret_key_{server_start_str}'.encode()).hexdigest() app.secret_key = secure_key app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(seconds=300) flag = os.environ.get('FLAG', "flag{this_is_a_fake_flag}") secret = uuid.UUID('31333337-1337-1337-1337-133713371337') def…