Your first hack, in 60 seconds
Every Daily Hack works the same way: read the briefing, look at the evidence, type the answer. Try it here first - no XP, no pressure.
Developers sometimes leave notes in a page's source code that visitors never see. This login page ships one. Read the source below and find the staff password.
<form action="/login" method="post">
<input name="user" placeholder="Username">
<input name="pass" type="password" placeholder="Password">
<!-- TODO: remove before launch - staff password is "sunrise" -->
<button>Sign in</button>
</form>
M2F14M3
Solved by
The redirect it only half checked
Loomhaus signs you in with OAuth. When it builds the sign-in link it checks that the redirect_uri you asked for belongs to the app, and its check is that the value starts with the registered address https://app.loomhaus.example. The authorization server will send the one-time code to whatever redirect_uri survives that check. A victim has already clicked a link you prepared; the attacker's logging endpoint recorded what arrived. Craft the redirect_uri that passes the check but delivers the code to the attacker, then read the code it captured.
Play freely - sign up to submit your answer and earn XP.