ROM Raider

🔐 ROM-Raider — Solution

#🗺️ Challenge Flow

---

#Stage 1 — Break the Lock [Web / JWT Exploitation]

#What the Player Sees

A GBA-styled login interface asking for a Trainer Name and Trainer ID (Password).

#Vulnerability

The backend validates JWT tokens but accepts alg: none — meaning a token with no signature is treated as valid.

#Step-by-Step Solution

Step 1 — Open browser DevTools → Sources or Network tab.

The following comment is visible in the page source: