Webverselabs Challenge Spindrift Workspace Cookie

Scenario :

Two founders, eighteen months in, no marketing budget, no AI features. They built their own session layer one weekend “because we don’t need a whole library for this.” A junior contractor noted in the team Linear that the cookie was “stateless and self-describing” and shipped it.

Solution :

I will speedrun this one since this one was pretty easy :

/Pricing , /Changelog , Field Notes : All of these returns static web pages that are pretty useless to us .

We will try to create an account :

If we try to use the Free plan , we’re given a default account , Bob@gmail.com :

Looking at the request, we can’t modify the role or anything like that during the login .

Once we login , we can view our account , or Open New Workspaces .

Now if we look closely at the request , the cookie ends with a “=” and looks like a base64 encoding , if we try to decode it :

We see that we have the role of a member, let’s try to modify the role and encode it again and see if we can get access as the Administrator :

echo "{"uid":42,"email":"bob@example","role":"admin","exp":1781607517}" | base64
e3VpZDo0MixlbWFpbDpib2JAZXhhbXBsZSxyb2xlOmFkbWluLGV4cDoxNzgxNjA3NTE3fQo=

Now back to the app , let’s modify the Cookie from the browser tools :

And from there we access the New Admin endpoint and get our flag that way .

That was all for this challenge, see you in the next one :)