Passman

Pandora discovered the presence of a mole within the ministry. To proceed with caution, she must obtain the master control password for the ministry, which is stored in a password manager.

we create a user and login:

we also create a note:

we can see that it's running graphql:

look at the query :

The query is:

mutation ($recType: String!, $recAddr: String!, $recUser: String!, $recPass: String!, $recNote: String!) {
  AddPhrase(
    recType: $recType,
    recAddr: $recAddr,
    recUser: $recUser,
    recPass: $recPass,
    recNote: $recNote
  ) {
    message
  }
}

also look at the jwt token :

Look at the code for updatePassword 👍

we use the login query and make it updatepassword:

and we get the password: