$ cat writeup.md…
$ cat writeup.md…
hackerlab
Task: Password manager web app with source code provided. Solution: IDOR vulnerability in /getPass/<user_id> endpoint - only checks session presence, not ownership. Register any user, then access /getPass/1 to retrieve admin passwords including the flag.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar