A Flask application with a login, a dashboard and a forgot-password form. The forgot-password flow writes the same session variables the login uses.
Pas commencéDockercommit b06690cx86_64 · aarch64Secret
Reach another user's dashboard without their password by abusing the session variables the forgot-password flow sets (session puzzling).
Le brief de ce lab se trouve dans son dépôt.