> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/ctf/downunderctf-2023/web/grades_grades_grades.md). # grades\_grades\_grades ### Challenge Description

### Challenge Attachment {% file src="/files/mMCTSQYuWFwCMoQP9iLD" %}

click on sign up to register a new user

taking a look at the source we find in the routes the flag route which is located at `/grades_flag`

but for some reason it says invalid token

let's decode the token and view the source code to find what is the token allowed to view the flag

let's decode it

if we take a look at the /grades\_flag route we can see that it checks if the teacher role is true

and if we see how the token is generated after signing up we will see that a property called is\_teacher is set to false by default if no value is given which makes the is\_teacher\_role() function returns false which makes the route /grades\_flag didn't show because it requires that the user is a teacher not student

so what we have to do is add the propertie is\_teacher ourselves when signing up and make it true so it's added to the token, first let's intercept the sign up request

now let's add the is\_teacher=true

copy the token returned in the response, let's decode it to check if the property is added successfully

so let's use this token

refresh the page and boom we have got the flag

### Flag ``` DUCTF{Y0u_Kn0W_M4Ss_A5s1GnM3Nt_c890ne89c3} ```