CASE 11 THE STASH Some things are saved where the page forgets to look.

// case notes

Veyra didn't just hide things in the page. He hid things in the browser itself. There is a storage layer that JavaScript can write to and read from a shelf that survives page reloads, tab closures, even browser restarts. It's called localStorage.

A script on this page has already stashed something. You won't find it in the HTML, the CSS, or the console output. You'll find it in the browser's own memory.

// the drop

> document.title

"Case 11 The Stash"

// the page looks clean. too clean.

> document.body.innerHTML.includes("ACCESS_")

false

// the token isn't in the markup.

// try looking where the browser keeps things between visits.

// evidence log, enter the stashed token

hint: Open Inspect element and look for localStorage or Use console.log()

> stash recovered. next case: Case 12 The Variable →