Your first hack, in 60 seconds
Every Daily Hack works the same way: read the briefing, look at the evidence, type the answer. Try it here first - no XP, no pressure.
Developers sometimes leave notes in a page's source code that visitors never see. This login page ships one. Read the source below and find the staff password.
<form action="/login" method="post">
<input name="user" placeholder="Username">
<input name="pass" type="password" placeholder="Password">
<!-- TODO: remove before launch - staff password is "sunrise" -->
<button>Sign in</button>
</form>
M2F14M3
Solved by
The header that skips the check
Mereton's internal console puts its login wall in Next.js middleware: every request to /admin is supposed to pass through it first. A researcher noticed the framework trusts a header it uses to talk to itself, and that nothing stops you from sending that header from the outside. The request to the admin dashboard is loaded in the editor. Make the middleware stand aside and read the admin API key the dashboard prints once you are in.
Play freely - sign up to submit your answer and earn XP.