The first thing I should do is try passing the authentication by sql injection and I tried a few queries but maybe it was url-encoded. When I tried with the query admin’ or ‘1’=’1# and check with Burp Suite. I sew:
wow!!! Maybe i know what i should do. I edited %23 into #
yeahhhhhh!I have been able to login it but there is no flag here because it only appears when you are logged in with admin privilege!
i tried check the cookie and edit its value to admin.
CONGRATULATIONS!
Flag is : CTF{kookie_cookies}
WRITE-UP FOR CHALLENGE!!! 