🍬 Welcome to the Sweetest Shop in Town!
The best candy, treats, and chocolate — delivered to your door
🌟 Featured Sweets
📦 New Arrivals
🍭 All Our Sweets
Browse our full collection of treats. Click any product to add to cart.
👷 Staff Area
Staff members get 50% off. This button is only for employees.
⭐ Customer Reviews
Read what our customers say — and leave your own review!
Leave a Review
⚠️ Hint for hackers: this review system doesn't filter your input. What happens if you put HTML in your review? What about <script> tags?
🔑 Customer Login
Hint: a really sloppy developer might have left the credentials somewhere easy to find. Have you tried looking at the source code?
📞 Contact Us
Email: hello@codekids-candy.example.com
Phone: 020 1234 5678
Open daily, 9am - 6pm
🗺️ Find Our Other Pages
We have other pages too — can you find them all? Try these URLs at the end of our website address:
- ?page=home (the front page)
- ?page=products (all sweets)
- ?page=admin (probably shouldn't visit this one...)
🚨 Admin Control Panel
RESTRICTED AREA — STAFF ONLY
You shouldn't be able to see this page! No login was required, you just changed the URL.
This is called Broken Access Control — the page doesn't check who you are.
🚩 FLAG{NO_AUTH_BIG_PROBLEM}
Customer Database
Alex Wilson — alex@example.com — Bought £45 of sweets
Jamie Patel — jamie@example.com — Bought £22 of sweets
Sam Chen — sam@example.com — Bought £67 of sweets
⚠️ This is what attackers see when websites have broken access control. Real customer data leaked!
💥 DDoS Attack Simulator
This is a SIMULATION. In a real DDoS attack, attackers flood a website with so many requests that it crashes.
Click "Send Lots of Requests" repeatedly and watch what happens. Real attackers use thousands of computers (a "botnet") to do this for real, taking websites offline.
🔧 Developer Debug Mode
You found the secret debug mode! This is what developers see when they're testing the site.
[DEBUG] Site version: 0.99-beta
[DEBUG] Active users: 247
[DEBUG] Database: candy_shop_db (size: 2.4 MB)
[DEBUG] Last error: "TypeError: undefined is not a function" at /admin/dashboard.js:42
[DEBUG] Admin password hint: starts with 'C' and rhymes with 'tandy'
[DEBUG] 🚩 FLAG{KONAMI_CODE_FOREVER}