The description of the challenge is the following:

“This website requires authentication, via POST. However, it seems as if someone has defaced our site. Maybe there is still some way to authenticate? http://165.227.106.113/post.php”

The first step that I did is to simply do an HTTP GET request using the curl command line tool


$ curl http://165.227.106.113/post.php

<h1>This site takes POST data that you have not submitted!</h1><!-- username: admin | password: 71urlkufpsdnlkadsf -->%

We can see a username and password as an html comment and thus we can make a pretty good guess that these are used in the POST request for authentication based on the description.

Easily enough a simple POST request gives us the flag

$ curl --data "username=admin&password=71urlkufpsdnlkadsf" http://165.227.106.113/post.php


<h1>flag{p0st_d4t4_4ll_d4y}</h1>%