All challenges
webeasyfree
Cookie monster.
50 ptsno solves
~brief
Acme's developers shipped a staff portal before the security review. The admin notes are supposedly restricted to administrators.
You recovered a copy of the page (portal.html). Serve it locally and see whether "restricted" really means anything:
python3 -m http.server 8000
# then open http://localhost:8000/portal.html
Browsers don't keep cookies for
file://pages, so use the local server.
»writeup
The writeup unlocks once you capture the flag.