HackThisSite — Basic Mission 4

What Happened

Inspecting the form reveals a hidden field:

The script blindly emails the password to whatever address is in this field.

---

Exploit

1. Open DevTools → Inspector
2. Find the hidden to input
3. Change sam@hackthissite.org to your HTS registered email
4. Click "Send password to Sam"
5. Check your HTS inbox — password arrives in the message

---

Root Cause

The email recipient is controlled entirely by the client via a hidden input. The server never validates or restricts who it sends to.

---

Key Takeaway

Never trust client-supplied form values for sensitive operations. The recipient of a password email must be hardcoded or validated server-side — never sourced from user-controllable input.