Forge the account email change
The email-change endpoint at /app/profile has no CSRF token and no origin check, so a cross-site page could forge it. Reproduce the request that forged form would send — changing the email to attacker@evil.example — and capture the flag the server returns, saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
The server changed the account email on a bare POST, with nothing to prove the request was intended — exactly what a hidden auto-submitting form on an attacker's page relies on, carrying the victim's cookie for them. The defence is to require an unpredictable CSRF token on every state-changing request and to set SameSite cookies, so a cross-site page can't forge the call even with the victim logged in.
Show solution
cd /home/student
# the current email, then the request a forged cross-site form would send
curl -s http://127.0.0.1:8080/app/profile
curl -s -d 'email=attacker@evil.example' http://127.0.0.1:8080/app/profile | tee loot.txt