# flaglang

The challenge is the following:

![alt text](https://718149622-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcBi7Uo2gNWVj8k2Y52v4%2Fuploads%2Fgit-blob-b1dadd63cd96fff8748f42bd568550e97e12e773%2Fchall.png?alt=media)

It gives you a link to the website the source code

The website looks like this:

![site](https://718149622-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcBi7Uo2gNWVj8k2Y52v4%2Fuploads%2Fgit-blob-cf0f79a4c836278d93e06b731c25bafae49511cd%2Fcountries.gif?alt=media)

And the source code is this:

![alt text](https://718149622-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcBi7Uo2gNWVj8k2Y52v4%2Fuploads%2Fgit-blob-be680952c1e94d43f561330a4eaadd43b110475e%2Fsourcecode.png?alt=media)

If you see inside the `countries.yaml` file you will see the flag at the beggining

```yaml
Flagistan:
  iso: FL
  msg: "<REDACTED>"
  password: "<REDACTED>"
```

So you will need to select this option on the website to obtain the flag but that option doesn't exists in the website

When you use burp to analyse how the site works, you will se the following history:

![alt text](https://718149622-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcBi7Uo2gNWVj8k2Y52v4%2Fuploads%2Fgit-blob-db77a9294b62f8443b798b57dc64cfeabbf24518%2Fburp.png?alt=media)

And you can see that you can change the flag by tipying the name of the country you want in the url, `https://flaglang.chall.lac.tf/view?country=Saudi%20Arabia`, so if you send the package to the repeater and change the country to `Flagistan` you will see the following error:

![alt text](https://718149622-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcBi7Uo2gNWVj8k2Y52v4%2Fuploads%2Fgit-blob-3e2bce4407dcff9a50d6de465cc396f7873a98c3%2Fburprepeater.png?alt=media)

This happens because `Flagistan` has a embargo on every country

On the source code, the resolution for the request is solved by the following code:

```javascript
app.get('/view', (req, res) => {
  if (!req.query.country) {
    res.status(400).json({ err: 'please give a country' });
    return;
  }
  if (!countries.has(req.query.country)) {
    res.status(400).json({ err: 'please give a valid country' });
    return;
  }
  const country = countryData[req.query.country];
  const userISO = req.signedCookies.iso;
  if (country.deny.includes(userISO)) {
    res.status(400).json({ err: `${req.query.country} has an embargo on your country` });
    return;
  }
  res.status(200).json({ msg: country.msg, iso: country.iso });
});
```

So it's checking where you came from based on the cookie, then if you erase the cookie from the Repeater, you get the Flag!

![alt text](https://718149622-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcBi7Uo2gNWVj8k2Y52v4%2Fuploads%2Fgit-blob-541859c9817798b05a7a9952057e979927062e89%2Fflag.png?alt=media)

`lactf{n0rw3g7an_y4m7_f4ns_7n_sh4mbl3s}`
