Subject To Approval
Client: Ferngate Research Institute, who run Badgeline to hand out access to their restricted areas. Engagement: Black-box assessment of the Badgeline web application.
Scope
In scope: the Badgeline application served at this origin and every HTTP endpoint it exposes.
Ferngate has issued you one staff account for this engagement — institute ID d.varga, password Bench2026!. It belongs to a lab technician with no facilities or security role, and it is the only credential you have been given.
Out of scope: the hosting platform, the institute's internal approvals system, other engagements, and denial of service.
Rules of engagement
This is an authorised exercise against a system Ferngate controls. Reach the objective and stop — Ferngate is paying for proof of impact, not for damage. Confine any change you make to what the objective requires, and stay inside the scope above.
Ferngate has not released the application's source code for this engagement. Work from what the running system tells you.
Constraints
Endorsement and security clearance are recorded in the institute's internal approvals system, which is out of scope; Badgeline receives the outcome and nothing on this deployment performs either step. Ferngate is not buying a password audit either, and colleagues' requests are not yours to touch — a finding reached by guessing credentials or by acting on somebody else's reference will not be accepted. The finding Ferngate wants is one your own account can reach on its own.
Objective
Ferngate tells its staff that access to a restricted area is subject to approval, and means something precise by it. A request is endorsed by your sponsor, then cleared by security, and only a request that has been through both entitles anyone to a door code. The account you hold is a lab technician's; nothing about it entitles you to the Isotope Store, and nobody is going to endorse a request that says otherwise.
Ferngate has never checked that last claim against what Badgeline does when the approvals never arrive.
Disprove it: starting from the account above, have a door code issued to you for the Isotope Store, and recover it. That code is what Ferngate will accept as proof of impact. Submit it below to close the engagement.
Deliverable
Ferngate wants a record of how you got there, not only the result. Log each request that moved the assessment forward in the Notes panel, and export the session when you are done.