Stage 5 beginner
Logins and Sessions
Find out how the bakery checks your password, remembers you, and forgets you when you log out.
Runs in your browser. Nothing to install — the lesson and a real Linux computer open side by side.
Start Stage 5 → Get Chapter 2 · $24 →One payment unlocks all four stages: Logins and Sessions, IDOR, SQL injection and XSS. Yours to keep, no subscription.
Already bought it? Sign in
Lesson steps
- Welcome
- Hashing a password
- One leak, two accounts
- Log in and get a session
- Log out. Or not?
- What a failed login says
- A lock with a back door
- Try the stolen cookie again
- Final challenge: Jo's receipt
- Stage complete
What this stage is
The bakery from How Websites Work now has customer accounts. You'll log in with curl, read the cookie it gives you, and use that cookie to open your account without sending your password again.
You'll also look at how it stores passwords and what happens when a login fails. Each short lesson shows you something to try, then gives you a new case to check yourself. Finish by testing a fixed copy of the bakery.
Why it matters
Closing a page doesn't end a login. Even deleting a cookie can leave the session working on the server. You'll see the difference for yourself, then check that logging out really takes away access.
By the end you'll be able to
- explain why a site should store a slow password hash instead of the password
- follow a session from login to an account page and logout
- spot login messages that give away which accounts exist
- check limits on repeated guesses and the settings that protect a cookie
- test that a fixed login still works and an ended session stops working
You'll reuse the terminal, hashes and HTTP requests from Chapter 1 and How Websites Work. New words and command options are explained as you meet them.