# Beep beep boop

## Humanoid Security – SSS

| Info       | Details          |
| ---------- | ---------------- |
| Category   | Web Exploitation |
| Difficulty | Easy             |

## Challenge Overview

> I entered the website, checked for the **cookies**, analyzing the **page source**, but nothing seemed to catch my eyes.

Fuzzing this with **gobuster** (using **common.txt** from **SecLists**), **dirsearch** or other tools, was the solution to reveal that there is `/robots.txt`. A very beginner path but somehow I didn't think of it in my first steps.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FOcAJrtROGBymdwjliE2C%2Ffuzz.png?alt=media&#x26;token=143100aa-8733-4426-bc73-3940f8db88d4" alt=""><figcaption><p>fuzzing</p></figcaption></figure>

Going to `/robots.txt` path we get this

```
User-agent: *
Disallow: /73656372657420666f72204153494d4f.php
```

That long string seems to be **hex encoded** so when we decode it using **CyberChef** we get:\
`secret for ASIMO`

Doing a little bit of research I saw that **ASIMO** was the best humanoid robot.\
However, going to this path: `/73656372657420666f72204153494d4f.php`

We see a simple text:\
"This is a secure area that can only be accessed by the most advanced humanoid robots."

> When we talk about access we often talk in fact about **cookies** or **sessionID**.\
> Analyzing the **cookies** we see this:

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FOUjl8Vtgalsp3cewYNlh%2Fcookies.png?alt=media&#x26;token=a1a68c5e-5c78-45ee-a20d-e5465f26196e" alt=""><figcaption><p>cookies</p></figcaption></figure>

Changing its value from `HUMAN` to `ASIMOV` and refreshing the page we get the flag in front of our face.

> **Note:** ASIMO is inspired by **Isaac Asimov**, the well-known science fiction writer. I found that he wrote in some of his stories and novels about intelligent robots and their interaction with humans.

It was a bit guessy and weird challenge to be honest.

## Final Flag

`SSS{hum4n0id5_and_c00ki3s}`&#x20;

*made by k0d*
