Your first hack, in 60 seconds
Every Daily Hack works the same way: read the briefing, look at the evidence, type the answer. Try it here first - no XP, no pressure.
Developers sometimes leave notes in a page's source code that visitors never see. This login page ships one. Read the source below and find the staff password.
<form action="/login" method="post">
<input name="user" placeholder="Username">
<input name="pass" type="password" placeholder="Password">
<!-- TODO: remove before launch - staff password is "sunrise" -->
<button>Sign in</button>
</form>
M2F14M3
Solved by
The name that points nowhere
Kestrel Bank keeps a tidy DNS zone, which is the problem. One of its subdomains still has a CNAME pointing at a cloud bucket that the marketing team deleted when a campaign ended. The name resolves, the target does not exist, and anyone can walk up to that cloud provider and claim the empty name. Whoever does gets to serve content from a genuine kestrelbank.example address. Cross-reference the records and name the subdomain that can be taken over.
Play freely - sign up to submit your answer and earn XP.