The role cookie
On entry the target sets a role cookie. The server trusts whatever the cookie says. Change your role to admin and reload.
Solve challenge → No login requiredJAVASCRIPT IN PRACTICE
Tamper the request
Change a request parameter, cookie or header to obtain a hidden value. Practice working with HTTP.
- HTTP parameters
- Cookies
- Server responses
First challenge without login · Free
Selected challenges to get started
Pick a challenge and explore the rules through a concrete example.
Forged role token (Base64)
The token cookie is Base64-encoded JSON holding a role (looks like a JWT payload, but has no signature - which is exactly why it is forgeable). Decode it, change the…
Solve challenge → No login requiredThe debug parameter
The target runs in normal mode. But the page hints at a debug mode toggled by a URL parameter (GET). Turn it on and claim the flag.
Preview challenge → Free account required to solveReady for more?
Available challenges: 37.
See all challenges →The full catalogue requires a free account.
How should you approach these challenges?
HTTP request modification exercises show how parameters, headers and cookies affect an application response. Working with prepared targets helps you understand the boundary between browser-controlled data and rules the server should enforce.
Open the target and inspect the initial request and response. Identify the parameter, header or cookie that may affect the task condition. Change one element, repeat the request and compare responses. Editing text in Elements changes the local view; testing server behaviour requires an actual request.
Put it into practice: The role cookie →
Solve this challenge without creating an account.