Level1

i got the

Username Password AuthID

i tried some javascript injections but i cant get it to work

Have you tried looking at the original cookie before JS injection? You'll notive two of those are unnecessary.

Ok, i change the AuthID and i get this message at the bottom of the page

You are logged in as: john doe Warning: Cannot modify header information - headers already sent by (output started at /home/hbh/public_html/challenges/real1/index.php:21) in /home/hbh/public_html/challenges/real1/index.php on line 40

am i doing it right, just something wrong with HBH server?

Worked for me, send me a pm with what you did and i'll try and find any mistake you may have done.

Yeah, that "shit" doesn't affect what you have to do - just what's originally set. You'd see johndoe's AuthID, but instead you see nothing. Just assume there was a value for AuthID that corresponded to johndoe, and act appropriately.