Your first hack, in 60 seconds
Every Daily Hack works the same way: read the briefing, look at the evidence, type the answer. Try it here first - no XP, no pressure.
Developers sometimes leave notes in a page's source code that visitors never see. This login page ships one. Read the source below and find the staff password.
<form action="/login" method="post">
<input name="user" placeholder="Username">
<input name="pass" type="password" placeholder="Password">
<!-- TODO: remove before launch - staff password is "sunrise" -->
<button>Sign in</button>
</form>
M2F14M3
Solved by
The cookie that was an object
Pennywharf's Java app stores your session in a cookie and trusts it on the way back in. The cookie is not a signed token and it is not JSON: it is the raw session object, encoded. That matters, because if the server rebuilds an object straight from bytes a client sent, the client gets to choose what gets built. Decode the cookie in the workbench and read the signature at the very start. Name the format this cookie is really in.
Play freely - sign up to submit your answer and earn XP.