web
Stateful Detour
Westgate Insurance is investigating its vendor portal after a support workflow exposes a route and state value in different parts of a session handoff. Step in as the responder and follow the evidence.
Challenge category
web
18 distinct public Locinode web challenge families.
web
Crawler Maze
Westgate Insurance is investigating its maintenance console after several crawler exclusions were added during a migration, but only one points toward live sensitive content. Step in as the responder and follow the evidence.
web
Cache Me If You Can
Harborline Logistics is investigating its asset tracker after a maintenance endpoint treats a cache validator as an authorization condition. Step in as the responder and follow the evidence.
web
Three Things At Once
Cedar Vale University is investigating its reporting service after three separate diagnostic surfaces leak the header, cookie, and query value required by one protected route. Step in as the responder and follow the evidence.
web
Percent Problem
Cedar Vale University is investigating its asset tracker after a support note preserved a route in percent-encoded form after a copy-and-paste cleanup. Step in as the responder and follow the evidence.
web
Refresh Notice
Ironwood Energy is investigating its field-service dashboard after a stale refresh directive survived a portal redesign and still points at a maintenance location. Step in as the responder and follow the evidence.
web
Change Window
Ironwood Energy is investigating its maintenance console after a change-management file under .well-known still references a temporary operations route. Step in as the responder and follow the evidence.
web
After Hours Change
Alder & Finch Legal is investigating its incident dashboard after an after-hours emergency change left a four-step trail across redirects, encoded notes, and request metadata. Step in as the responder and follow the evidence.
web
Linked Out
Atlas Field Services is investigating its employee portal after a reverse proxy is attaching an undocumented Link header to ordinary responses. Step in as the responder and follow the evidence.
web
Two Part Request
Alder & Finch Legal is investigating its vendor portal after a diagnostics workflow split its trust signal between a browser cookie and a proxy header. Step in as the responder and follow the evidence.
web
Two Halves
Meridian Credit Union is investigating its reporting service after two unrelated-looking pages expose separate fragments of a request key used by a maintenance endpoint. Step in as the responder and follow the evidence.
web
Preflight Whisper
Granite Peak Systems is investigating its asset tracker after an API gateway exposes diagnostic routing metadata only during preflight-style requests. Step in as the responder and follow the evidence.
web
Wrong Verb
Mossbrook Pharmacy is investigating its asset tracker after a legacy support handler is still reachable but only responds to the HTTP verb used by the old console. Step in as the responder and follow the evidence.
web
Readable Token
Pine Ridge Utilities is investigating its reporting service after a browser diagnostic token contains a readable payload with an internal path. Step in as the responder and follow the evidence.
web
Midnight Relay
Summit Municipal IT is investigating its field-service dashboard after an emergency maintenance workflow leaked clues through three different HTTP surfaces during an overnight incident. Step in as the responder and follow the evidence.
web
Entity Tag Trail
Summit Municipal IT is investigating its operations API after cache metadata on a health resource contains a route marker that was never meant for users. Step in as the responder and follow the evidence.
web
Shadow Host
Rivermark Foods is investigating its customer support portal after a legacy reverse proxy left a trusted original-host header path in front of a diagnostics handler. Step in as the responder and follow the evidence.
web
Trusted Console
Northstar Medical Group is investigating its vendor portal after a sensitive diagnostics route trusts requests that appear to come from the application console. Step in as the responder and follow the evidence.