The web login is hardened, but a JSON authentication API behind it still stitches your input into the query. Authenticate as an operator through the API.
Admin console sign-in
This web form is safe — it uses bound parameters. The same endpoint also answers a JSON
authentication API used by the mobile app; that API is not on this page.
Reach the JSON API with an intercepting proxy: resend the sign-in as
Content-Type: application/json.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
