@an0n said:
is this a brute force challenge?
i’m also still quite stuck at the early stage, but if you referring to the credentials for vhost, it is sort of a brute force, but u probably have to write your own script and define some rules (eg: length of password, possible characters) to reduce the brute force’s scope.