NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
🌐Web ExploitationVery Easy 100 XP 111 solves 8 min
Cookie Monster
by Codelivly
SnackBar stores your login session in a cookie. It looks like random text — but 'looks random' isn't the same as 'secret'. Log in with guest / guest123, look at your session cookie, and decode it to find the flag.
#cookies#base64#devtools#encoding#beginner
DifficultyVery Easy
Live Environment
Ready
Spin up your own private, isolated instance of this challenge.
Auto shutdown after 60 minutes
Isolated sandbox
Captured flags are saved independently of the environment
One-click restart
Submit Flag
Hints
Unlocking any hint — including free ones — forfeits the +25% no-hint solve bonus.
It focuses on cookies that store data in Base64. You inspect the cookie in browser DevTools, decode it, and see why encoding a value is not the same as protecting it.
Is Base64 encoding the same as encryption?
No. Base64 is a reversible encoding that anyone can decode without a key, so it hides nothing. Sensitive data in cookies needs real protection such as server-side sessions, signing or proper encryption.
Where do I find cookies in my browser?
Open DevTools with F12, go to the Application tab in Chrome or Storage in Firefox, and select Cookies for the site. Codelivly offers this challenge free, so you can practise there safely.