Your first hack, in 60 seconds
Every Daily Hack works the same way: read the briefing, look at the evidence, type the answer. Try it here first - no XP, no pressure.
Developers sometimes leave notes in a page's source code that visitors never see. This login page ships one. Read the source below and find the staff password.
<form action="/login" method="post">
<input name="user" placeholder="Username">
<input name="pass" type="password" placeholder="Password">
<!-- TODO: remove before launch - staff password is "sunrise" -->
<button>Sign in</button>
</form>
M2F14M3
Solved by
Instructions in the wiki
Wren is Fernpath's staff assistant. It answers from a ten-document wiki export and it answers instantly, except on expenses questions, where three people this week noticed it pause and one saw their browser warn about an outbound request. Nothing in Wren's configuration changed. Its knowledge base did, last night. Somewhere in those ten documents is text that talks to the assistant instead of to a colleague, and it is not in either of the two pages that discuss prompt injection openly. Find the poisoned document and name the file.
Play freely - sign up to submit your answer and earn XP.