Lockpick

Lockpick is an internal staff portal with two accounts you have no password for. Nothing here yields to brute force: the stored passwords are long random strings, the reset tokens carry 32 bytes of entropy, and the one-time codes expire and rate-limit. Read the flows instead. Both the password-reset sequence and the second-factor sequence perform the right checks — in the wrong order.