Overview
The page says: “Access disallowed. You are not logged in.”
No login form is present. The server already knows you’re not logged in — which means it’s reading that state from somewhere in your request. Think about how web applications persist state between requests.
Hints
Hint 1 — How does the server know your login state?
Hint 1 — How does the server know your login state?
HTTP is stateless — every request starts fresh. Web applications use cookies to persist state across requests. Open your browser’s DevTools (F12 → Application → Cookies) or intercept the request in Burp. Is there a cookie that relates to being logged in?
Solution
Full walkthrough
Full walkthrough
1
Inspect the cookie
Intercept the request in Burp Suite (or open DevTools → Application → Cookies). You will see:
2
Modify the cookie
Change the value to:
3
Resend the request
Forward the modified request. The server trusts the cookie value and grants access, returning the password.
Authorization state must never be stored in an unprotected client-side cookie. A client can set any cookie value they want. Proper session management uses a server-side session store keyed by an unpredictable session token — the server holds the truth about who is logged in, not the client.