Forging the 'already verified' state

Authentication proves who is making a request. A bypass is any path that reaches an authenticated state without presenting the secret that state is meant to require — a default credential, a flawed comparison, a token that is trusted when it should not be, a step in a flow that can be skipped.

This lab: Forging the 'already verified' state. Get past the login without the credential it is supposed to demand.

Work it against your own copy of the target. When you have the flag, submit it below.

Reach a page or an action that should require a valid login, without holding valid credentials. Capture the flag shown once you are through.