Your first hack, in 60 seconds
Every Daily Hack works the same way: read the briefing, look at the evidence, type the answer. Try it here first - no XP, no pressure.
Developers sometimes leave notes in a page's source code that visitors never see. This login page ships one. Read the source below and find the staff password.
<form action="/login" method="post">
<input name="user" placeholder="Username">
<input name="pass" type="password" placeholder="Password">
<!-- TODO: remove before launch - staff password is "sunrise" -->
<button>Sign in</button>
</form>
M2F14M3
Solved by
Who signs your token
Caldera's shipment API accepts signed tokens from partner carriers. A token arrives, the API needs the public key that will verify it, and the library it uses is helpful: rather than making the team maintain a list of partner keys, it reads where to fetch the key from the token itself. That is a real header field, it is in the specification, and libraries really do honour it. Three different hostnames appear in this token and they are all plausible. Only one of them decides whether the signature is trusted, and it is the one an attacker gets to choose. Decode the token and submit the host the verifier would go to for the key.
Play freely - sign up to submit your answer and earn XP.