INNER CODE UNIT · Python

api_admin_flag

The-Art-of-Hacking/websploit · additional-labs/token-tower/app.py:911

def api_admin_flag():
    """Get the admin flag - requires admin role"""
    token = get_token_from_request()
    
    if not token:
        return jsonify({"error": "No authorization token provided"}), 401
    
    try:
        payload = verify_token_vulnerable(token)
        if not payload:
            return jsonify({"error": "Invalid token"}), 401
        
        if payload.get('role') != 'admin':
            return jsonify({"error": "Admin access required", "your_role": payload.get('role')}), 403
        
        return jsonify({
            "message": "Congratulations! You've gained admin access!",
            "flag": FLAGS['privilege_escalation'],

View source record →