← Back to all challenges ◆◆ Level 3 · Cookie Tampering · 150 XP
Wargames Realm

Just a Regular User

This page decides whether to show the admin panel by reading a cookie off your browser. Cookies live on your machine — which means you can edit them.

Your account

Open DevTools → Application (Chrome) or Storage (Firefox) → Cookies. You'll see a role=user cookie. Change its value to admin and refresh the panel. Or run in the Console: document.cookie='role=admin'

Submit the flag

Why it matters: never trust a role, user ID, or price stored in a cookie. The server must look up the real role from a session it controls — a forged cookie should grant nothing.