Skip to content

Startup R0

{ "message": "Okay great, show out your arm and take the entry stamp. Also take this Authorization token, you'll need to show it to the bouncer as well to get in. Head on over to /get-carded to go forward.", "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlbWFpbCI6Im1hZGhhbm1vaGFuLnJtc0BnbWFpbC5jb20iLCJkYXRlIjoiMjAyNS0xMS0xNiAwNjo1NjoxNSJ9.YzqOKzccv-0z6VBNOtB6UcP-tbi1gEtsDCPTzvkTnOw" }

fetch('https://workwithus.startup-challenge.example.com/get-carded', { headers: { 'Authorization': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlbWFpbCI6Im1hZGhhbm1vaGFuLnJtc0BnbWFpbC5jb20iLCJkYXRlIjoiMjAyNS0xMS0xNiAwNjo1NjoxNSJ9.YzqOKzccv-0z6VBNOtB6UcP-tbi1gEtsDCPTzvkTnOw' } }).then(r => r.json()).then(console.log)

{ "message": "Okay great, you've made it so far! For the next step, you need to get past our super secret API bouncer.\n\nThey don't let people in at all unless you tell them that you're coming from startup-challenge.example.com and that you're actually hari_seldon. You can send a POST request to this route to talk to the bouncer." }

{ "message": "Okay great, you've made it so far! For the next step, you need to get past our super secret API bouncer.\n\nThey don't let people in at all unless you tell them that you're coming from startup-challenge.example.com and that you're actually hari_seldon. You can send a POST request to this route to talk to the bouncer." }

get-carded:1 GET https://workwithus.startup-challenge.example.com/get-carded 403 (FORBIDDEN) allow pasting VM4474:1 Uncaught SyntaxError: Unexpected identifier 'pasting' fetch('https://workwithus.startup-challenge.example.com/get-carded', { headers: { 'Authorization': 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlbWFpbCI6Im1hZGhhbm1vaGFuLnJtc0BnbWFpbC5jb20iLCJkYXRlIjoiMjAyNS0xMS0xNiAwNjo1NjoxNSJ9.YzqOKzccv-0z6VBNOtB6UcP-tbi1gEtsDCPTzvkTnOw' } }).then(r => r.text()).then(console.log)

Promise {} VM4486:1 GET https://workwithus.startup-challenge.example.com/get-carded 403 (FORBIDDEN) (anonymous) @ VM4486:1 {"error":"Hmmm...this doesn't look right. Why don't these match?"}

fetch('https://workwithus.startup-challenge.example.com/get-carded', { headers: { 'token': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlbWFpbCI6Im1hZGhhbm1vaGFuLnJtc0BnbWFpbC5jb20iLCJkYXRlIjoiMjAyNS0xMS0xNiAwNjo1NjoxNSJ9.YzqOKzccv-0z6VBNOtB6UcP-tbi1gEtsDCPTzvkTnOw' } }).then(r => r.json()).then(console.log)

Promise {} VM4940:1 GET https://workwithus.startup-challenge.example.com/get-carded 403 (FORBIDDEN) (anonymous) @ VM4940:1 {error: "Hmmm...this doesn't look right. You're missing something."} fetch('https://workwithus.startup-challenge.example.com/get-carded', { headers: { 'Authorization': 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlbWFpbCI6Im1hZGhhbm1vaGFuLnJtc0BnbWFpbC5jb20iLCJkYXRlIjoiMjAyNS0xMS0xNiAwNjo1NjoxNSJ9.YzqOKzccv-0z6VBNOtB6UcP-tbi1gEtsDCPTzvkTnOw' } }).then(r => { console.log('Status:', r.status); console.log('Headers:', [...r.headers.entries()]); return r.json(); }).then(console.log)

Promise {} VM4962:1 GET https://workwithus.startup-challenge.example.com/get-carded 403 (FORBIDDEN) (anonymous) @ VM4962:1 VM4962:6 Status: 403 VM4962:7 Headers: (5) [Array(2), Array(2), Array(2), Array(2), Array(2)]0: (2) ['connection', 'keep-alive']1: (2) ['content-length', '67']2: (2) ['content-type', 'application/json']3: (2) ['date', 'Sun, 16 Nov 2025 07:03:40 GMT']4: (2) ['server', 'nginx/1.24.0 (Ubuntu)']length: 5Prototype: Array(0) {error: "Hmmm...this doesn't look right. Why don't these match?"}

fetch('https://workwithus.startup-challenge.example.com/get-carded', { method: 'POST', headers: { 'Authorization': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlbWFpbCI6Im1hZGhhbm1vaGFuLnJtc0BnbWFpbC5jb20iLCJkYXRlIjoiMjAyNS0xMS0xNiAwNjo1NjoxNSJ9.YzqOKzccv-0z6VBNOtB6UcP-tbi1gEtsDCPTzvkTnOw' } }).then(r => r.json()).then(console.log)

Promise {} {message: "Okay great, you've made it so far! For the next st…OST request to this route to talk to the bouncer."}

message: "Okay great, you've made it so far! For the next step, you need to get past our super secret API bouncer.\n\nThey don't let people in at all unless you tell them that you're coming from startup-challenge.example.com and that you're actually hari_seldon. You can send a POST request to this route to talk to the bouncer.

"Prototype: Object

fetch('https://workwithus.startup-challenge.example.com/begin', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ name: “Madhan Mohan S”, email: “madhanmohan.rms@gmail.com”})
}); 

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlbWFpbCI6Im1hZGhhbm1vaGFuLnJtc0BnbWFpbC5jb20iLCJkYXRlIjoiMjAyNS0xMS0xNiAwNjo0Njo0OCJ9.1vXwFQX3lKfYKjedKEVE8TcfsOqLVVO1GQA2zROqSdc"

auth_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlbWFpbCI6Im1hZGhhbm1vaGFuLnJtc0BnbWFpbC5jb20iLCJkYXRlIjoiMjAyNS0xMS0xNiAwNjo0Njo0OCJ9.1vXwFQX3lKfYKjedKEVE8TcfsOqLVVO1GQA2zROqSdc

'User-Agent': 'hari_seldon'
    'Referer': 'https://startup-challenge.example.com',
\n\n

ccurl -X GET "https://workwithus.startup-challenge.example.com/logic-it-out"
-H "User-Agent: hari_seldon"
-H "Referer: https://startup-challenge.example.com"
-H "Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlb"

curl -X GET "https://workwithus.startup-challenge.example.com/logic-it-out"
-H "Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlbWFpbCI6Im1hZGhhbm1vaGFuLnJtc0BnbWFpbC5jb20iLCJkYXRlIjoiMjAyNS0xMS0xNiAwOTo0MTowMiJ9.otd4AuxTJMAA43beCzGSJ7xjN2xXRJHW0G4mXU1-5Hw"
-H "Referer: https://startup-challenge.example.com"
-H "User-Agent: hari_seldon"

fetch('https://workwithus.startup-challenge.example.com/logic-it-out', { method: 'GET', headers: { 'Authorization': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiTWFkaGFuIE1vaGFuIFMiLCJlbWFpbCI6Im1hZGhhbm1vaGFuLnJtc0BnbWFpbC5jb20iLCJkYXRlIjoiMjAyNS0xMS0xNiAwOTo0MTowMiJ9.otd4AuxTJMAA43beCzGSJ7xjN2xXRJHW0G4mXU1-5Hw', 'Referer': 'https://startup-challenge.example.com', 'User-Agent': 'hari_seldon' } }) .then(response => response.json()) .then(data => console.log(data)) .catch(error => console.error('Error:', error));

{ "instruction": "Welcome to trivia night! Only the smartest and fastest will proceed! The questions array contains 3 questions and the format in which the answer is expected. Answer all the 3 questions in the right format and send it as a POST request to /fastest-fingers-first containing a JSON with 2 fields: token: str and answers: list[str|int] within 5 seconds. Tick-tock, the timer is crucial!", "questions": [ { "answer_type": "str", "question": "Which metal is liquid at room temperature?" }, { "answer_type": "str", "question": "What is the largest mammal in the world?" }, { "answer_type": "int", "question": "What is the cube of 4?" } ], "token": "eyJhbnN3ZXJzIjpbIk1lcmN1cnkiLCJCbHVlIHdoYWxlIiw2NF19.aRnA8g.U88_I1dWNoIyWP5wx9UhVeDE-rg" }

GIN] 2025/11/16 - 18:13:19 | 200 | 12.635839416s | 127.0.0.1 | POST "/api/generate" [GIN] 2025/11/16 - 18:13:53 | 200 | 1.260440292s | 127.0.0.1 | POST "/api/generate" [GIN] 2025/11/16 - 18:13:53 | 200 | 1.742902583s | 127.0.0.1 | POST "/api/generate"

get_off_my_lawn_robots

  • obfuscate the code
  • set a breakpoint on submit
  • check the logic
  • run the js

https://github.com/PV-Sudarsan/workwithus.startup-challenge.example.com/blob/main/quiz.mjs final puzzle https://www.postman.com/material-specialist-92282473/workwithus-startup-challenge-com/overview

my collection https://web.postman.co/workspace/My-Workspace~f6f2faaf-6da2-40ab-83f8-478609c16b76/request/26628912-4ccf0176-1edb-4b2a-b5ef-ff471687c83a?sideView=agentMode

Sql Vs Mysql

Previous Page

Startup

Next Page

On this page

No Headings