> For the complete documentation index, see [llms.txt](https://rayyanwong.gitbook.io/rayyan/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rayyanwong.gitbook.io/rayyan/ctfs/lag-n-crash-2022-march/lnc2022-writeups/outline-2-web-exploitation.md).

# Outline 2 ( Web exploitation )

Challenge: Outline 2

Same webpage as Outline 1. Made an account, signed in. Typed {{users}} to see possible users I could intercept.

![](https://1548390168-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMePZib3zSv2WjhGvbhgS%2Fuploads%2Fc2MTK8qf8SFBMmZhWGAK%2Fimage.png?alt=media\&token=3b88dec4-8f25-4b76-b43a-340bd0d9af13)

This was the output from using payload {{users}}

![](https://1548390168-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMePZib3zSv2WjhGvbhgS%2Fuploads%2FS6TJ4ayz537lJWYIL1Ai%2Fimage.png?alt=media\&token=2bac1c12-ab1e-426f-bfdd-ba743a01b5d2)

I found some website that could decrypt password hashes for me and got the password **`b1g5h0t$`**

![](https://1548390168-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMePZib3zSv2WjhGvbhgS%2Fuploads%2FRqNVw4hlslk1RaGADgpl%2Fimage.png?alt=media\&token=7568e22a-5731-4b4e-9b0e-aa9d0adc2ba6)

I logged into the admin's account and accessed the web directory /flag.

![](https://1548390168-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMePZib3zSv2WjhGvbhgS%2Fuploads%2FfwXA7xfy0BqEnXuHrhyE%2Fimage.png?alt=media\&token=fa964d4f-7caf-4dfb-8c55-6b5e68fce635)

<mark style="color:blue;">**`LNC2022{n0t_4s_s1mpl3_fl4sk_s3rv3r_s1d3_t3mpl4t3_1nj3c10n}`**</mark>