Tries --:--:-- left
Next hack in --:--:--
Warm-up

Your first hack, in 60 seconds

Every Daily Hack works the same way: read the briefing, look at the evidence, type the answer. Try it here first - no XP, no pressure.

Mission briefing

Developers sometimes leave notes in a page's source code that visitors never see. This login page ships one. Read the source below and find the staff password.

Investigate
<form action="/login" method="post">
  <input name="user" placeholder="Username">
  <input name="pass" type="password" placeholder="Password">
  <!-- TODO: remove before launch - staff password is "sunrise" -->
  <button>Sign in</button>
</form>
Your answer
Daily Hack #137 First blood M2F14M3 Solved by Cybertuffi 5ynT4x3rRor Kayhan demosai JSTCE tomekmsliwa

The key the heap kept

Web & API Security Difficulty Medium ~5 min +10 XP
Mission briefing
Situation Voltaro's billing app exposes Spring Actuator The hack A heap dump holds what /env masks Goal Recover the payment API key it really uses
Investigate
Your answer

Play freely - sign up to submit your answer and earn XP.

Solved! +10 XP
First blood! You were first to crack today's hack.
How it works

Up next Pro
Play next hack

Nice one!

Sign up free to claim your +10 XP and start your series.

Claim +10 XP - sign up free
36,000+ Hackers Real labs Free
Start Hacking Free or solve today's hack, no account needed