$ cat writeup.md…
$ cat writeup.md…
hackerlab
Task: Access John Doe's notes in a notes service with JWT authentication. Solution: IDOR via Header Injection - the server accepts Firstname/Lastname from HTTP headers instead of JWT claims, allowing identity spoofing.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar