HackThisSite — Basic Mission 10

---

Reconnaissance

Submitted a random password → got:

You are not authorized to view this page

Opened DevTools → Storage → Cookies and spotted:

Name	Value
level10_authorized	no

The entire access control decision is made client-side via a cookie value.

---

Exploitation

1. Open DevTools → Storage → Cookies
2. Find level10_authorized
3. Change value from no → yes
4. Refresh the page

Congratz!

---

Root Cause

Authorization state stored in an unprotected, user-writable cookie. No server-side session validation — the server blindly trusts the cookie value.

---

Key Takeaway

Never store authorization decisions in client-side cookies without cryptographic signing (e.g. HMAC). Any cookie the user can edit must never control access to protected resources.