http://r2km7u25qebaefa7b6jdcjldymc2u337vzpx7ne773ypgs3qlq4xycqd.onion/index.php?page=Momentum2
I decided to check for common backup extensions: $ ffuf -u http://[TARGET_IP]/ajax.phpFUZZ -w /path/to/SecLists/Discovery/Web-Content/raft-large-extensions.txt This scan revealed: .bak [Status: 200, Size: 357, Words: 84, Lines: 14]
.phps [Status: 403, Size: 279, Words: 20, Lines: 10] The ajax.php.bak file contained valuable information: //The boss told me to add one more Upper Case letter at the end of the cookie
if(isset($_COOKIE['admin']) &&...