demo@ratpractice.io · recovery=backup@ratpractice.io · theme=light · password changed=FalseThis is a realistic account app with several state-changing actions. Most of them are properly defended (a session-bound token that is actually checked, plus an Origin check). Your job: enumerate every action, test each one's protection (drop / blank / reuse / swap the token, forge the Origin, try GET), subtract what is genuinely enforced, and forge the one action that is not. One weak spot accepts junk tokens but only mutates a cosmetic preference - a decoy. The win is a state change that actually matters.
Hint: do not stop at the first field that accepts a bad token - ask whether that field is worth stealing. Compare how each endpoint responds to a request with no valid token AND a foreign Origin. The PoC Tester can fire each shape so you can watch which one actually mutates without protest.
More hands-on practice → labs.hackxpert.com