MoveWell Physio remember-me forgery
A physical-therapy appointment portal. The "remember me" cookie is XORed with a key the client-side JS also ships.
PentestingHere Academy
Official Academy lab
- Attempts
- 1
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
MoveWell Physio's "remember this device" cookie stores the account id XORed with a key, then base64-encoded. A client-side script that animates the checkbox ships that same key as a constant.
Goal
Log in as another account, dr_hale, by presenting a "remember this device" cookie it accepts. The flag is dr_hale's practice note.