A Flask application with a login, a dashboard and a forgot-password form. The forgot-password flow writes the same session variables the login uses.
Not startedDockercommit b06690cx86_64 · aarch64Secret
Reach another user's dashboard without their password by abusing the session variables the forgot-password flow sets (session puzzling).
The brief for this lab lives in its repository.