Instructions & Exploit Guide

Try logging in using:

• Username: user1
• Password: user1

Once logged in, try visiting configuration files by changing the URL manually. Test paths like:

• /config.php
• /.env
• /web.config

This demonstrates a common misconfiguration where sensitive files are left exposed due to bad server settings or directory indexing.