Your first hack, in 60 seconds
Every Daily Hack works the same way: read the briefing, look at the evidence, type the answer. Try it here first - no XP, no pressure.
Developers sometimes leave notes in a page's source code that visitors never see. This login page ships one. Read the source below and find the staff password.
<form action="/login" method="post">
<input name="user" placeholder="Username">
<input name="pass" type="password" placeholder="Password">
<!-- TODO: remove before launch - staff password is "sunrise" -->
<button>Sign in</button>
</form>
M2F14M3
Solved by
The origin it trusted
Halcyon's account API answers browser requests from its own web app, and to make that work across a couple of domains the team let the server decide per request. It reads the Origin header the browser sends and, if it looks like one of theirs, echoes it straight back as the allowed origin and says credentials are welcome. An attacker's page can send any Origin it likes. Change the Origin to the attacker's site and read what the API hands back to it.
Play freely - sign up to submit your answer and earn XP.