Account Login

Scenario

SecurePanel lets logged-in users change their email from a simple POST form. The form has no one-time token or referrer check. Change the account email without using the legitimate UI flow.

Your approach

1. Log in with the provided demo credentials on the account panel.
2. Use dev tools or an intercepting proxy to capture the email change request.
3. Replay the POST from curl or a self-made HTML form without session UI.
4. Confirm the email updates and the lab displays a success flag.
5. Submit the flag shown after the change.