The user ID is alpaca and the password is pacapaca.
Beginner Hint
- You cannot capture the flag even by logging in.
- Examining
index.phpreveals that it outputs the flag after sending a response header that redirects the user tologin.php. Does this part of the code not get executed? - While a standard browser request results in a redirect to
login.php, but there are several ways to view the contents ofindex.php.