Warning: This post contains a solution!
Only continue if:
1.) you want to see a possible alternative solution or
2.) you are stuck and need a hint!
Login using given credentials.
The message on the page is:
There is nothing on this page
A look into the
source code of the page shows that a 1x1 pixel image is included.
<div id="content"> There is nothing on this page <img src="files/pixel.png"> </div>
This seems to be an uninteresting PNG image. Checking it using
strings don't reveal something interesting.
Next check is to take a look to the contents of the
files/ folder, which shows up a file called
users.txt because directory listing is enabled in the Apache configuration.
The password for the next level is found in this file.
# username:password alice:BYNdCesZqW bob:jw2ueICLvT charlie:G5vCxkVV3m natas3:sJIJNW6ucpu6HPZ1ZAchaDtwd7oGrD14 eve:zo4mJWyNj2 mallory:9urtcpzBmH