Complete password reset
You asked to reset your password. The link we generated for you is below. Confirm it to set a new password. In this sandbox no password actually changes — completing a reset for an account that is not yours reveals the flag.
The user and token are submitted as pinned fields — change them with an
intercepting proxy.
Your reset link
/labs/misc/10/?confirm&user=you&token=639bae9a
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.