Craft an off-site redirect
The redirect helper at /app/go?next= doesn't check its destination. Craft a request that redirects a victim off-site to https://evil.example, and capture the flag the server returns, saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
The redirect obeyed your next value with no same-site check, so a link on the real domain quietly delivered the victim to an attacker's page. Only ever redirect to destinations you control — a fixed allow-list or relative paths — and reject absolute URLs you didn't build.
Show solution
cd /home/student
curl -s 'http://127.0.0.1:8080/app/go?next=https://evil.example/login' | tee loot.txt