$ cat writeup.md…
$ cat writeup.md…
hackerlab
Task: Flask web app with user registration/login where is_admin is hardcoded to false; user input is concatenated into JSON without escaping. Solution: inject closing quote and additional is_admin key into password field, exploiting Python json.loads() duplicate-key-last-wins behavior to escalate to admin.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar