Account settings — shared token pool
This form requires an anti-CSRF token and checks it is valid. But validity is all it checks. You have your own account here too; use what it gives you.
Signed in as
victim
Current email on file
victim@uncrypt.io
Token issued to your own attacker session (from a page you legitimately loaded):
6c698c3617d977d7
Attacker page HTML:
This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.