Know the people who do insurance.
As a prerequisite to viewing the information on Peak's website, I agree to comply with all applicable privacy laws and to keep all proprietary information, all nonpublic personal information, and any other confidential information that I view or acquire on Peak's website, confidential. I understand that by logging in, I agree with these terms.
If you have not downloaded the password list, do so here. If you did, procede to the next hint.
BurpSuite is a handy tool to automating requests
- You should have already gotten the valid email address from step one
- Download the password list to your downloads directory
- Launch BurpSuite
- Depending on your BurpSuite configuration, either launch the BurpSuite browser or use a Browser Extension
- Browswer -> Fill out the valid email from step one. Put in any random password you want
- BurpSuite -> Proxy Tab -> Turn on intercept to start capturing traffic
- Browser -> Click register button to submit the form
- BurpSuite -> You should see /api/users/login OPTIONS requet -> Forward
- You should see /api/users/login POST requet -> Right Click -> Send to Intruder
- Toggle off the proxy intercept off -> Go to Intruder tab
- Highlight the password you used inside the double quotes -> Click the 'Add S' button next to POSITIONS to make it a position variable
- In the 'Payload Configuration' section click load -> Selet the PASSWORD_LIST.txt file
- In the 'Payload Encoding' section, toggle off URL Encoding
- Click the Start Attack button -> Wait for the attack to finish -> Sort be response codes
- There is one response code of 200 for password
mustang. Use the valid email and this password to login and get the flag