Wwwsxyprn -

$ gobuster dir -u http://challenge.ctf.org/wwwsxyprn/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,html

sha1($hash . '') === $hash → sha1($hash) === $hash wwwsxyprn

HTTP/1.1 200 OK Set-Cookie: session=ab12cd34ef56...; HttpOnly; Secure "status":"ok","msg":"Welcome exploit!" $ gobuster dir -u http://challenge