Track A · Stage 7

1. Log in as a normal user and copy the JWT cookie. Base64url-decode the payload — it has "admin": false.

2. Build a new token: header {"alg":"none","typ":"JWT"}, payload {"user":"you","admin":true}, each base64url-encoded, joined by dots, with an empty signature (trailing dot). Why: the server's verifier honors alg:none and skips signature checking, so an unsigned token is trusted.

3. Replace the cookie with your forged token and open /admin for the flag. (scripts-style one-liner provided in README notes.)

Lesson: pin the expected algorithm, reject none, and verify signatures with a strong secret/key.

1. The endpoint POST /change-email relies only on the session cookie — no CSRF token. Host (or paste into the provided /attacker page) an auto-submitting form:

<form action=http://127.0.0.1:8072/change-email method=POST><input name=email value=attacker@evil.test></form><script>document.forms[0].submit()</script>.

Why: the victim's browser automatically attaches their session cookie to the cross-site request, and the server can't distinguish it from a legitimate one.

2. Click 'Send link to admin'; the bot visits your page and its email changes. The confirmation page then shows the flag.

Lesson: require a per-request CSRF token and set SameSite=Lax/Strict cookies.