Now the server is the target

In the first lab the mistakes were near the surface: the page showed too much, a URL or a cookie let you ask for the wrong thing. The fixes were all check on the server. This lab is about what happens when the server does check — and still trusts something it should not.

A token it believes without verifying. An object it saves whole, including fields you were never shown. A URL it fetches on your behalf, from inside its own network. A string it writes to a log and, in doing so, runs. Each one is the server extending its trust one step too far into data that came from you.

Same tool as before — the browser with its editable address bar, cookie drawer and View source tab. The flags are harder to reach and more satisfying when they fall.