I don’t get it. At all.
I’ve found the “Nope…” file.
I’ve bruteforced some login credentials and seen the “the list”.
I’ve seen the “not set” message and figured out how to change it to “incorrect”.
I’ve tried using the session value for the “incorrect” part. I’ve also tried decoding the session value. Part of it looks like b****4 encoding, but the rest looks like gibberish.
I’ve tried bruteforcing the “incorrect” part with a custom wordlist based on “the list”.
nmap, dirbuster, nikto, sqlmap, etc have found nothing else of value.
What the f**k am I missing?! Argh!