IP Address: 172.25.200.200

Port 9005

For this flag you’ll need to have BurpSuite open.

• If you are comfortable with BurpSuite, great.
• If not, do flag Red1 here

Click on the ‘Start Whisking’ folder first using the Burp browser.

In this challenge, we need to change a cookie value to ‘admin’.

Click through to the second page (VIP Room), and you’ll see this.

Turn on Burp Intercept, refresh the Page, and send it to the repeater. You’ll see this:

Change the user_type cookie to admin , send the request, and the flag will be revealed!