Рабочий стол (Desktop)

hackerlab

Task: Flask 'Windows XP desktop' app; guest session cookie {\"user\":\"guest\"} drives a SQLite file-list query; admin desk locked. Solution: crack the weak SECRET_KEY (crazy1) with flask-unsign, then forge a signed cookie whose 'user' value carries a UNION-based SQL injection to enumerate the users table (admin = Morris), forge {\"user\":\"Morris\"} and read flag.txt.