Challenge

A quotes API where a free user gets a limited number of quotes and the flag sits behind a subscriber check. The tell was an acc[key] = value merge built from the cookie, which is a prototype-pollution sink.

Approach

A few avenues opened up:

  • Pollute the count so a free request returns enough quotes that the flag quote is included.
  • Pollute Object.prototype with subscribed: true so the subscriber gate passes (the JWT path with alg: none was another way to forge subscriber status, but the decode was overwritten in a try block, so prototype pollution was cleaner).

Working the pollution against the gated endpoint surfaced the flag quote.