Now that we have the credentials, So I tried logging in using one of the username and password combinations from the list.
The username is valid, but then we received an invalid password
error. This is because we entered the password hash instead of the plaintext password.
However, the author mentioned that this challenge doesn't require any brute forcing or password cracking.
Since we don't need to crack passwords, let's revisit the hint we found earlier in the login.php
file.
Notice that the comment mentions something about juggling
, and they also provide a link to it.