← All Challenges
Challenge 34 of 66
Request Forger
🟠 Hard
Web App
+100 XP
The password change form has no CSRF token. Craft a request that changes the admin password when they visit your page.
Create a form that auto-submits to the change-password endpoint.
🏆 Challenge Complete!
Know someone who would enjoy this? Challenge them.
Keep going
Make it count.
Join free to earn XP for what you read and solve, keep a streak, and track your progress.
Join free