Session
Your session rides in the sid cookie — base64-encoded JSON. Decode it, change what it
says about you, re-encode it and replay the request with the new cookie.
Signed in as: unknown
Raw sid token
(not sent yet — reload once the cookie is set)
That string is not encrypted and not signed. It is an open envelope with your name on it.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.