Fools Mate — TryHackMe Writeup

Fools Mate is a TryHackMe room based on a chess web application. The challenge looks like a simple chess puzzle, but the real goal is to understand how the web application communicates with its backend.

The challenge asks us to bypass the chess engine and obtain the flag.

𝗟𝗮𝗯 𝗢𝘃𝗲𝗿𝘃𝗶𝗲𝘄

Room Name: Fools Mate Platform: TryHackMe Difficulty: Easy Category: Web

The room provides a chess web application where we need to find a way to make the required move and retrieve the flag.

𝗔𝗰𝗰𝗲𝘀𝘀𝗶𝗻𝗴 𝘁𝗵𝗲 𝗪𝗲𝗯 𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻

After starting the machine, I opened the provided machine IP in the browser.

The application displayed a chess board with the message:

Mate-in-one · White to move

At first, it looked like we simply needed to find the correct chess move.

However, when I tried making the move directly through the browser, the application triggered a message.

This made me look at what was actually happening behind the scenes.

𝗜𝗻𝘁𝗲𝗿𝗰𝗲𝗽𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗥𝗲𝗾𝘂𝗲𝘀𝘁 𝘄𝗶𝘁𝗵 𝗕𝘂𝗿𝗽 𝗦𝘂𝗶𝘁𝗲

Instead of interacting only with the frontend, I opened Burp Suite and intercepted the request generated when making a chess move.

After making a move on the board, Burp captured the request sent to the backend.

The request was sent to:

POST /api/move

The body contained two parameters:

{ "from": "h2", "to": "h4" }

This was interesting because the browser was simply sending the starting and destination squares to the backend.

𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝗶𝗻𝗴 𝘁𝗵𝗲 𝗥𝗲𝗾𝘂𝗲𝘀𝘁

The important parameters were:

"from"

and

"to"

The from parameter represents the starting square, while to represents the destination square.

Instead of depending on what moves the frontend allowed, I could directly modify these values inside the intercepted HTTP request.

𝗠𝗮𝗻𝗶𝗽𝘂𝗹𝗮𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗠𝗼𝘃𝗲

I modified the intercepted request and sent the move directly to the backend.

The request contained:

{ "from": "a1", "to": "a8" }

After forwarding the request, the server processed the move.

The response was:

{ "ok": true, "move": "…", "status": "checkmate", "turn": "b", "winner": "white", "flag": "THM{…}" }

The interesting part was that the server response itself contained the flag.

I won't include the actual flag here so readers can solve the challenge themselves.

𝗪𝗵𝗮𝘁 𝗛𝗮𝗽𝗽𝗲𝗻𝗲𝗱?

The main point of the challenge was not really about playing chess.

The browser provides a chess interface, but behind that interface it communicates with a backend API.

When a move is made, the browser sends something similar to:

{ "from": "a1", "to": "a8" }

to the:

/api/move

endpoint.

By intercepting the request with Burp Suite, we can see exactly what the application is sending to the server.

Instead of relying on the restrictions of the frontend, we can test how the backend handles the request directly.

𝗪𝗵𝘆 𝗗𝗼𝗲𝘀 𝗧𝗵𝗶𝘀 𝗪𝗼𝗿𝗸?

The important security concept here is:

Never trust the client.

The chess board is only the frontend. Any data sent by the browser can potentially be intercepted and modified before reaching the server.

If the backend does not properly validate the requested action, an attacker may be able to send requests that the frontend would normally prevent.

This is why security checks should always be performed on the server side.

𝗞𝗲𝘆 𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴𝘀

• The frontend should never be considered trusted. • Client-side restrictions can be bypassed by modifying requests. • Burp Suite can be used to intercept and modify HTTP requests. • APIs should validate every important parameter on the server side. • The actual application logic may be different from what the frontend allows. • Inspecting API requests is an important part of web application testing.

𝗙𝗶𝗻𝗮𝗹 𝗧𝗮𝗸𝗲𝗮𝘄𝗮𝘆

Fools Mate looked like a simple chess challenge, but the interesting part was actually the communication between the frontend and backend.

By capturing the chess move request in Burp Suite, I could see the parameters being sent to the /api/move endpoint.

After modifying the request, the backend returned a successful response containing the flag.

The main lesson is simple:

Don't trust what the frontend tells you. Always check what the backend actually accepts.

𝗖𝗼𝗻𝗰𝗹𝘂𝘀𝗶𝗼𝗻

This was a short but useful challenge for understanding how client-side logic can be bypassed by interacting directly with an application's API.

Burp Suite made it easy to capture the request, modify the parameters, and observe the server's response.

📬 Stay Connected

If you found this helpful and want to learn more about web security, hands-on labs, feel free to follow me for upcoming posts.

✍️ Follow me for more cybersecurity write-ups 🔗 LinkedIn — codermayank 📸 Instagram — @mayhack_

Tags: #BugBounty #EthicalHacking #CyberSecurity #Linux #PwnCollege #CTF #CaptureTheFlag #LinuxSecurity #PenetrationTesting #WebSecurity #InfoSec