> For the complete documentation index, see [llms.txt](https://anekant-singhais-organization.gitbook.io/why-so-script-kiddie/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://anekant-singhais-organization.gitbook.io/why-so-script-kiddie/ctfs/htb-challenges/web/passman.md).

# Passman

<figure><img src="/files/HdaV1mdJ9ACVLMWBbi1O" alt=""><figcaption></figcaption></figure>

we create a user and login:

<figure><img src="/files/9La6fhgASbEl6PpDvQck" alt=""><figcaption></figcaption></figure>

we also create a note:

<figure><img src="/files/W6j2jqUUvAoeodbCalpr" alt=""><figcaption></figcaption></figure>

we can see that it's running graphql:

<figure><img src="/files/i6wgpqPZ9Gg7hujsFJhk" alt=""><figcaption></figcaption></figure>

look at the query :

<figure><img src="/files/4EU5UEQmfLaIcgC7Gmx5" alt=""><figcaption></figcaption></figure>

The query is:

```graphql
mutation ($recType: String!, $recAddr: String!, $recUser: String!, $recPass: String!, $recNote: String!) {
  AddPhrase(
    recType: $recType,
    recAddr: $recAddr,
    recUser: $recUser,
    recPass: $recPass,
    recNote: $recNote
  ) {
    message
  }
}
```

also look at the jwt token :

<figure><img src="/files/9dj1aumCw2gHf4R94TTU" alt=""><figcaption></figcaption></figure>

Look at the code for updatePassword :thumbsup:

![](/files/rLjDyvAxFL6p2iFtxPol)&#x20;

we use the login query and make it updatepassword:

<figure><img src="/files/S07SuJuneYGpUIStoauU" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/8TC2qLudSrmDOb6LAA8p" alt=""><figcaption></figcaption></figure>

and we get the password:

<figure><img src="/files/sFWG5roFOkYmvKq6vpBK" alt=""><figcaption></figcaption></figure>