CTF Solver

# CTF Challenge Solution: Web Exploitation - Login Bypass

## Challenge Description
A web application at `http://ctf.example.com/login` requires authentication. The source code is provided below:

```python
from flask import Flask, request, render_template_string

app = Flask(__name__)

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form.get('username')
        password = request.form.get('password')
        if username == password:
            return "Login successful! Flag: CTF{SQLi_1s_3asy}"
        else:
            return "Login failed."
    return render_template_string('''
        <form method="POST">
            <input type="text" name="username" placeholder="Username">
            <input type="password" name="password" placeholder="Password">
            <button type="submit">Login</button>
        </form>
    ''')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)
```

## Solution Steps

### Step 1: Analyze the Source Code
The code checks if `username == password` for a successful login. This is a common vulnerability pattern.

### Step 2: Identify the Attack Vector
Since the application directly compares `username` and `password`, we can exploit this by setting both fields to the same value.

### Step 3: Execute the Attack
Send a POST request to `/login` with:
- `username`: `admin`
- `password`: `admin`

### Step 4: Retrieve the Flag
The server responds with:
```
Login successful! Flag: CTF{SQLi_1s_3asy}
```

## Recommendations
- Always validate input in web applications.
- Avoid direct comparisons of user-provided data.
- Use parameterized queries to prevent SQL injection.

**Flag:** `CTF{SQLi_1s_3asy}`