GateKeeper staff portal (auth cookie)
A staff portal keeps your role in an unsigned cookie you can rewrite.
PentestingHere Academy
Official Academy lab
- Attempts
- 10
- Solves
- 6
- Published
- 6 Sep 2026
Scenario
GateKeeper is a staff portal. When you sign in, it stores your session in an auth cookie.
The dashboard reads your role from that cookie.
Goal
Reach the admin console on /dashboard.php and submit the master gate code it
prints as the flag. A normal staff user only sees "Admin console is restricted."