Web Security / TryHackMe Walkthrough

Fool's Mate — Bypassing Client-Side Validation (TryHackMe Write-up) by TheCyberAryan

Room: Fool's Mate
Difficulty: Easy
Category: Web Security / Client-Side Validation

Imagine opening a chess website. Everything looks normal, nice UI, smooth animations.

Pieces glide across the board.

You move a rook…

The website suddenly panics.

"I'll shut down your PC if you play that."

That's… oddly specific.

Whenever software gets emotional, I get curious.

Time to Become a Professional Button Clicker

First rule of hacking:

If the website says "Don't click that", you absolutely need to know why.

So before clicking random squares like an intoxicated pigeon, I started with enumeration.

nmap -Pn -sC -sV -p- 10.49.169.194

Nothing fancy.

• No FTP
• No SMB
• No database hanging out in public.

Just a Node.js web app silently judging my life choices.

Step Two: Stalking the Website

Time to ask the internet's favorite question:

"Who are you?"

whatweb http\://10.49.169.194

Answer:

Express
Endgame Trainer

Interesting…

Express means JavaScript.

JavaScript means…

Someone probably trusted the browser.

And trusting the browser is like asking the fox to guard the chicken coop.

Then I Read the JavaScript…

Developers often hide the funniest secrets in JavaScript.

After scrolling through the code, I found this little gem:

if (probe.isCheckmate()) {
    showSystemNotice("I'll shut down your PC if you play that.");
    return false;
}

I actually laughed.

The browser wasn't preventing illegal chess moves.

It was preventing winning.

Imagine a football referee saying:

"Sorry, scoring goals isn't allowed."

Wait…

Read that code again.

Who is making the decision?

The browser.

Not the server.

The browser.

That means the security guard is literally standing outside my own house.

And guess who owns the house?

Me.

The Biggest Lie in Web Security

The browser tells the server:

"Don't worry, I already checked everything."

Meanwhile hackers:

"Yeah… about that…"

The browser is just JavaScript.

JavaScript is just code.

Code can be ignored.

So I Fired the Browser

Who needs Chrome?

Meet my new employee:

CURL

No animations.

No chessboard.

No warnings.

No dramatic popups threatening my PC.

Just raw HTTP.

I sent exactly one request:

curl -X POST http\://10.49.169.194/api/move \\
-H "Content-Type: application/json" \\
-d '{"from":"a1","to":"a8"}'

The Server's Response?

Instead of yelling at me…

It happily replied:

{
  "status":"checkmate",
  "winner":"white",
  "flag":"THM{cl13nt_s1d3_ch3ckm4t3}"
}

Wait…

That's it?

The browser spent all that effort screaming…

…and the server was completely okay with it.

😂 The Browser Was Basically Doing This

Browser

NO!!
YOU CAN'T PLAY THAT!!
IT'S CHECKMATE!!
I'M TELLING MOM!!

Meanwhile the Server

Looks legal.
Nice move.
Here's your flag.

So What Actually Happened?

Let's simplify it.

Normal User

You
\
Browser
\
"Oh no!
That's checkmate!"
\
Request blocked

Hacker

You > curl > Server > "Looks good" > Flag

The browser never got invited to the party.

The Lesson Every Pentester Should Tattoo on Their Brain

Browsers are liars.

Well…

Not exactly liars.

They're employees of the attacker.

If I'm the attacker…

• I own the browser.
• I decide what JavaScript runs.
• I decide what requests get sent.

The server should never trust anything coming from me.

Moral of the Story

If your security depends on JavaScript…

It doesn't depend on security.

It depends on hope.

And hope is not an authentication mechanism.

Final Flag

THM{cl13nt_s1d3_ch3ckm4t3}

"The browser said 'Don't do it.'
curl asked 'Why not?'
The server shrugged… and handed over the flag."