Scan the machine

sudo nmap -sC -sV -sS -O -A -oN nmap.txt --min-rate=1000 -Pn -p 22,80 --open 10.129.227.93 

go to website

Now let’s go and intercept the request

As we see we manged to get invalid password

Let’s change the content type to JSON

As we see we still getting invalid password that validates the backend accepts the JSON content type

let’s change the password to true

As we see we managed to get a valid token

Now let’s continue to the application

As we see we managed to login to the application and got two files user.txt and homedirectory.zip files

Now let’s download the user file

As we see we managed to get the flag