Fuzz-Buzz

This level shows just a button Get Access.

Clicking the buttons just shows the text:

Team - MadGuyyy doesn't have access to do this

View page source. It reveals a hidden input field with base64 encoded value.

<form action="/levels/bmU2LzVEYk9YALOOLEYGOBHILEYTINDEYLEYPYAAZLEYADRAKLEYGHIYALEYTORILEYSHIMLAMIRCHLEYTINDEYLEYOOPSISAIDTINDEYLEYTWICE==" accept-charset="UTF-8" method="post"><input type="hidden" name="authenticity_token" value="VVGxI85LrO~~~~Cd9iLeA" autocomplete="off" />
<div class="form-group" style="padding-bottom: 20px;">
<input type="text" class="form-control" id="code" name="code" value="SmF2YXNjcmlwdCBiZWxvdzogCgoKCltdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dWyhbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dKVsrIStbXStbK1tdXV0rKFtdW1tdXStbXSlbKyErW11dKyghW10rW10pWyErW10rIStbXSshK1tdXSsoISFbXStbXSlbK1tdXSsoISFbXStbXSlbKyErW11dKyhbXVtbXV0rW10pWytbXV0rKFtdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW10pWytbXV0rKCEhW10rW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0pWyshK1tdK1srW11dXSsoISFbXStbXSlbKyErW11dXSgoISFbXStbXSlbKyErW11dKyghIVtdK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW10pWytbXV0rKFtdW1tdXStbXSlbK1tdXSsoISFbXStbXSlbKyErW11dKyhbXVtbXV0rW10pWyshK1tdXSsoK1shW11dK1tdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dKVsrIStbXStbKyErW11dXSsoISFbXStbXSlbIStbXSshK1tdKyErW11dKygrKCErW10rIStbXSshK1tdK1srIStbXV0pKVsoISFbXStbXSlbK1tdXSsoISFbXStbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXSlbKyErW10rWytbXV1dKyhbXStbXSlbKFtdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0pWyshK1tdK1srW11dXSsoW11bW11dK1tdKVsrIStbXV0rKCFbXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdKVsrW11dKyghIVtdK1tdKVsrIStbXV0rKFtdW1tdXStbXSlbK1tdXSsoW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0rW10pWyErW10rIStbXSshK1tdXSsoISFbXStbXSlbK1tdXSsoISFbXStbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXSlbKyErW10rWytbXV1dKyghIVtdK1tdKVsrIStbXV1dWyhbXVtbXV0rW10pWyshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCgrW10pWyhbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dKVsrIStbXStbK1tdXV0rKFtdW1tdXStbXSlbKyErW11dKyghW10rW10pWyErW10rIStbXSshK1tdXSsoISFbXStbXSlbK1tdXSsoISFbXStbXSlbKyErW11dKyhbXVtbXV0rW10pWytbXV0rKFtdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW10pWytbXV0rKCEhW10rW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0pWyshK1tdK1srW11dXSsoISFbXStbXSlbKyErW11dXStbXSlbKyErW10rWyshK1tdXV0rKCEhW10rW10pWyErW10rIStbXSshK1tdXV1dKCErW10rIStbXSshK1tdK1shK1tdKyErW11dKSsoIVtdK1tdKVsrIStbXV0rKCFbXStbXSlbIStbXSshK1tdXSkoKShbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXVsoW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0rW10pWyErW10rIStbXSshK1tdXSsoISFbXStbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXSlbKyErW10rWytbXV1dKyhbXVtbXV0rW10pWyshK1tdXSsoIVtdK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW10pWytbXV0rKCEhW10rW10pWyshK1tdXSsoW11bW11dK1tdKVsrW11dKyhbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdKVsrW11dKyghIVtdK1tdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dKVsrIStbXStbK1tdXV0rKCEhW10rW10pWyshK1tdXV0oKCEhW10rW10pWyshK1tdXSsoISFbXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdKVsrW11dKyhbXVtbXV0rW10pWytbXV0rKCEhW10rW10pWyshK1tdXSsoW11bW11dK1tdKVsrIStbXV0rKFtdK1tdKVsoIVtdK1tdKVsrW11dKyghIVtdK1tdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dKVsrIStbXStbK1tdXV0rKFtdW1tdXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dKyhbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dKVsrIStbXStbK1tdXV0rKCFbXStbXSlbIStbXSshK1tdXSsoISFbXStbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXSlbKyErW10rWytbXV1dKyghIVtdK1tdKVsrIStbXV1dKClbKyErW10rWyErW10rIStbXV1dKygoISFbXStbXSlbK1tdXStbIStbXSshK1tdKyErW10rIStbXV0rWyErW10rIStbXV0rKCEhW10rW10pWytbXV0rWyshK1tdXStbIStbXSshK1tdKyErW10rIStbXSshK1tdXStbIStbXSshK1tdKyErW10rIStbXSshK1tdKyErW10rIStbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoW11bW11dK1tdKVshK1tdKyErW11dKyghIVtdK1tdKVsrW11dK1srIStbXV0rWyErW10rIStbXSshK1tdXStbIStbXSshK1tdKyErW10rIStbXSshK1tdKyErW10rIStbXV0rKCEhW10rW10pWytbXV0rWyshK1tdXStbIStbXSshK1tdKyErW10rIStbXSshK1tdKyErW11dK1shK1tdKyErW10rIStbXSshK1tdKyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghW10rW10pWyErW10rIStbXV0rKFtdW1tdXStbXSlbK1tdXSsoISFbXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdKVsrW11dK1shK1tdKyErW10rIStbXSshK1tdKyErW10rIStbXSshK1tdXStbIStbXSshK1tdKyErW11dKyhbXVtbXV0rW10pWyshK1tdXSsoISFbXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdKVsrW11dK1srIStbXV0rWyErW10rIStbXSshK1tdKyErW10rIStbXSshK1tdXStbIStbXSshK1tdKyErW10rIStbXSshK1tdKyErW10rIStbXV0rKCEhW10rW10pWytbXV0rWyshK1tdXStbIStbXSshK1tdKyErW11dK1shK1tdKyErW10rIStbXSshK1tdKyErW10rIStbXSshK1tdXSsoISFbXStbXSlbK1tdXStbKyErW11dK1shK1tdKyErW10rIStbXSshK1tdKyErW10rIStbXV0rWyErW10rIStbXSshK1tdKyErW10rIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoW11bW11dK1tdKVsrW11dKyghIVtdK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW10pWytbXV0rWyErW10rIStbXSshK1tdKyErW11dK1shK1tdKyErW11dKVsoIVtdK1tdKVshK1tdKyErW10rIStbXV0rKCsoIStbXSshK1tdK1srIStbXV0rWyshK1tdXSkpWyghIVtdK1tdKVsrW11dKyghIVtdK1tdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dKVsrIStbXStbK1tdXV0rKFtdK1tdKVsoW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0rW10pWyErW10rIStbXSshK1tdXSsoISFbXStbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXSlbKyErW10rWytbXV1dKyhbXVtbXV0rW10pWyshK1tdXSsoIVtdK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW10pWytbXV0rKCEhW10rW10pWyshK1tdXSsoW11bW11dK1tdKVsrW11dKyhbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdKVsrW11dKyghIVtdK1tdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dKVsrIStbXStbK1tdXV0rKCEhW10rW10pWyshK1tdXV1bKFtdW1tdXStbXSlbKyErW11dKyghW10rW10pWyshK1tdXSsoKCtbXSlbKFtdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0pWyshK1tdK1srW11dXSsoW11bW11dK1tdKVsrIStbXV0rKCFbXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdKVsrW11dKyghIVtdK1tdKVsrIStbXV0rKFtdW1tdXStbXSlbK1tdXSsoW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0rW10pWyErW10rIStbXSshK1tdXSsoISFbXStbXSlbK1tdXSsoISFbXStbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXSlbKyErW10rWytbXV1dKyghIVtdK1tdKVsrIStbXV1dK1tdKVsrIStbXStbKyErW11dXSsoISFbXStbXSlbIStbXSshK1tdKyErW11dXV0oIStbXSshK1tdKyErW10rWyshK1tdXSlbKyErW11dKyghW10rW10pWyErW10rIStbXV0rKFshW11dK1tdW1tdXSlbKyErW10rWytbXV1dKyghIVtdK1tdKVsrW11dXSgoISFbXStbXSlbK1tdXSlbKFtdWyghIVtdK1tdKVshK1tdKyErW10rIStbXV0rKFtdW1tdXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dKyghIVtdK1tdKVsrIStbXV0rKFshW11dK1tdW1tdXSlbKyErW10rWytbXV1dKyghIVtdK1tdKVshK1tdKyErW10rIStbXV0rKCFbXStbXSlbIStbXSshK1tdKyErW11dXSgpK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0pWyshK1tdK1srW11dXSsoWyFbXV0rW11bW11dKVsrIStbXStbK1tdXV0rKFtdW1tdXStbXSlbKyErW11dXSgoW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV1bKFtdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0pWyshK1tdK1srW11dXSsoW11bW11dK1tdKVsrIStbXV0rKCFbXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdKVsrW11dKyghIVtdK1tdKVsrIStbXV0rKFtdW1tdXStbXSlbK1tdXSsoW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0rW10pWyErW10rIStbXSshK1tdXSsoISFbXStbXSlbK1tdXSsoISFbXStbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXSlbKyErW10rWytbXV1dKyghIVtdK1tdKVsrIStbXV1dKCghIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWyErW10rIStbXSshK1tdXSsoISFbXStbXSlbK1tdXSsoW11bW11dK1tdKVsrW11dKyghIVtdK1tdKVsrIStbXV0rKFtdW1tdXStbXSlbKyErW11dKyghW10rWytbXV0pWyhbIVtdXStbXVtbXV0pWyshK1tdK1srW11dXSsoISFbXStbXSlbK1tdXSsoIVtdK1tdKVsrIStbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoWyFbXV0rW11bW11dKVsrIStbXStbK1tdXV0rKFtdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dK1tdKVshK1tdKyErW10rIStbXV0rKCFbXStbXSlbIStbXSshK1tdKyErW11dXSgpWyshK1tdK1srW11dXSshW10rKCFbXStbK1tdXSlbKFshW11dK1tdW1tdXSlbKyErW10rWytbXV1dKyghIVtdK1tdKVsrW11dKyghW10rW10pWyshK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyhbIVtdXStbXVtbXV0pWyshK1tdK1srW11dXSsoW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0rW10pWyErW10rIStbXSshK1tdXSsoIVtdK1tdKVshK1tdKyErW10rIStbXV1dKClbKyErW10rWytbXV1dKSgpWyhbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXStbXSlbIStbXSshK1tdKyErW11dKyghIVtdK1tdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dKVsrIStbXStbK1tdXV0rKFtdW1tdXStbXSlbKyErW11dKyghW10rW10pWyErW10rIStbXSshK1tdXSsoISFbXStbXSlbK1tdXSsoISFbXStbXSlbKyErW11dKyhbXVtbXV0rW10pWytbXV0rKFtdWyghW10rW10pWytbXV0rKCFbXStbXSlbIStbXSshK1tdXSsoIVtdK1tdKVsrIStbXV0rKCEhW10rW10pWytbXV1dK1tdKVshK1tdKyErW10rIStbXV0rKCEhW10rW10pWytbXV0rKCEhW10rW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0pWyshK1tdK1srW11dXSsoISFbXStbXSlbKyErW11dXSgoIVtdK1srW11dKVsoWyFbXV0rW11bW11dKVsrIStbXStbK1tdXV0rKCEhW10rW10pWytbXV0rKCFbXStbXSlbKyErW11dKyghW10rW10pWyErW10rIStbXV0rKFshW11dK1tdW1tdXSlbKyErW10rWytbXV1dKyhbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXStbXSlbIStbXSshK1tdKyErW11dKyghW10rW10pWyErW10rIStbXSshK1tdXV0oKVsrIStbXStbK1tdXV0pK1tdKVsrIStbXV0pKyhbXStbXSlbKCFbXStbXSlbK1tdXSsoISFbXStbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXSlbKyErW10rWytbXV1dKyhbXVtbXV0rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXSsoW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0rW10pWyErW10rIStbXSshK1tdXSsoISFbXStbXVsoIVtdK1tdKVsrW11dKyghW10rW10pWyErW10rIStbXV0rKCFbXStbXSlbKyErW11dKyghIVtdK1tdKVsrW11dXSlbKyErW10rWytbXV1dKyghW10rW10pWyErW10rIStbXV0rKCEhW10rW11bKCFbXStbXSlbK1tdXSsoIVtdK1tdKVshK1tdKyErW11dKyghW10rW10pWyshK1tdXSsoISFbXStbXSlbK1tdXV0pWyshK1tdK1srW11dXSsoISFbXStbXSlbKyErW11dXSgpWyshK1tdK1shK1tdKyErW11dXSkoKSk=" hidden="true">
<input type="text" class="form-control" id="grant_access" name="grant_access" value="false" hidden="false;">
<input type="text" class="form-control" id="action_by" name="action_by" value="MadGuyyy;"  hidden="true">
</div>
<input type="submit" name="commit" value="Get Access" class="btn btn-primary" data-disable-with="Get Access" />
</form>

Decode this base64 and it gives a javascript code (JSF*ck to be precise)

Executing this JS code (or decode it online if you are paranoid like me) gives this:

"old_value;new_value"

Now you get a hint to change the values in form (or intercept the request) and append new value to it after a semicolon.

Change grant_access from false to false;true

Change action_by from MadGuyyy to MadGuyyy;admin

Old request:

.....&grant_access=false&action_by=MadGuyyy

New request:

grant_access=false;true&action_by=MadGuyyy;admin

And we have the flag!