Skip to content
CHALLENGE01/ 06

WEB // BEGINNER

Ticket Tamper

Exploit an unsafe object merge to inherit a protected priority value.

STATUSREADYBeginner

CHALLENGE BRIEF

Brief

A JSON customizer recursively merges user input into a fresh object. Reach inherited priority without supplying a top-level priority property.

Objective

Make a blank object report priority = rush, then recover the generated flag.

Input
JSON object
Success
({}).priority === "rush"
Attack surface
prototype chain

INTERACTIVE LAB

Run the lab

YOUR NEXT MOVE

Trace what the merge inherits, not only what the payload owns.

OPTIONAL HINTS

Hints

No hints opened. Hints do not affect progress.

    FINAL ANSWER

    ONE LAST STEP

    SUBMIT YOUR FLAG.

    Preparing challenge…