HackThisSite — Basic Mission 5

---

What Happened

Sam tried to secure the email script further, but the recipient address is still controlled by a hidden form field:

No actual server-side validation was added.

---

Exploit

Identical to Basic 4:

1. Open DevTools → Inspector
2. Find the hidden to input
3. Replace value with your HTS registered email
4. Click "Send password to Sam"
5. Password arrives in your HTS inbox

---

Root Cause

Security was claimed but not implemented. The "extra measures" didn't address the actual vulnerability — client-controlled recipient in the form payload.

---

Key Takeaway

Security through obscurity or minor tweaks doesn't fix a fundamental design flaw. If the root cause (client-controlled sensitive input) isn't fixed, the exploit still works.