# Sokudo

> Today our favorite typing application went back online. Today's hint is ***BAC.***

After creating two accounts, clicking and typing away. I could not find anything that worked in BurpSuite. I spend a good amount of time trying different things to see other user's data, trying to change it, but everything was secure. That was until I opened up my localStorage to see what the application had hidden there.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FHY8POk5f5iHbVK1Cdd0p%2Fimage.png?alt=media&#x26;token=aedd736d-8e8d-4ef6-aa6c-a88e6e90b893" alt=""><figcaption></figcaption></figure>

The token looked a lot like a timestamp! When I was checking stuff in BurpSuite, I saw that `/api/stats/leaderboard` was a bit chatty and showed the last login from every user. So I looked at the last login from the admin account.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FxnS9ugp9ARsWDZoMDGhW%2Fimage.png?alt=media&#x26;token=4237328a-da76-483d-8a0f-0c48401c95d4" alt=""><figcaption></figcaption></figure>

I took that data and made my own token out of it by deleting all characters and whitespaces. This resulted in `20251205075404` . I took that token, stored it in my own localStorage and refreshed the page.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2Fucojrhbll5g6ZYuXgLYn%2Fimage.png?alt=media&#x26;token=f5393d20-d969-4d87-818c-767bdb852dcf" alt=""><figcaption></figcaption></figure>

And just like that I had access to the admin panel and found my flag 🇧🇪
