I was a bit clueless here. So, I took hints. First was
- What actions could you perform as a regular user on the last level, which you can't now?
So, in last level there was no authentication required to edit the page. Now there is this added step which is disallowing me to edit the page. To capture the first flag, I already used the SQL injection technique. This was no hint at all. Sought the next hint which was
- Just because request fails with one method doesn't mean it will fail with a different method
This still isn't enough for me. I need to try to edit the page to get the flag. First option is to go through UI, which I already did. Next option now will be to use command line. I need to be sure now. Took the last hint too
- Different requests often have different required authorization
Yes, command line should be used here. curl provides heaps of useful features like HTTP POST. I tried with following command
curl -v -X POST http://35.190.155.168/3ba49d9466/page/edit/2
Successful execution of this command will give me the flag I needed.
