Description

The page redirects non-admin users away, but it prints the password in the response body before the header("Location: ...") redirect. Most browsers follow the redirect silently, but disabling redirect-following reveals the body.

Overview

• PHP sends a Location header and then continues executing, so the password may be printed before the browser follows the redirect.
• requests follows redirects by default; allow_redirects=False captures the pre-redirect response.

Solution

response = requests.get(url, auth=("natas22", current_password), allow_redirects=False)
result = re.search(r"The password for natas23 is (.*)", response.text).group(1).strip()

Password

qjA8cOoKFTzJhtV0Fzvt92fgvxVnVRBj