Account settings
You are viewing the victim's logged-in account. The "Update email" form below posts to this same endpoint. Your job: get that email changed without the victim ever submitting the form.
Signed in as
victim
Current email on file
victim@uncrypt.io
The application's real "Update email" form (for reference — this is what the app serves):
<form method="POST" action="index.php">
<input name="email" value="victim@uncrypt.io">
<button>Update email</button>
</form>
Attacker page — paste the HTML you would host on your own site. When you deliver it, the victim's browser (already logged in here) opens it.
This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.