$ cat writeup.md…
$ cat writeup.md…
hackerlab
Task: a FastAPI service set a numeric id cookie and challenged the player to become admin in an app for only 128 users. Solution: recognize that authorization trusted the unsigned cookie, brute-force the tiny id space, and use id=72 to enter admin mode and recover the flag.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar