HackThisSite — Basic Mission 2

Vulnerability

Missing password file — no comparison possible.

---

Analysis

The script loads the password from an external .txt file, then compares it to whatever the user submits.

Sam never uploaded that file.

When the file is missing, the script has nothing to compare against — so submitting an empty string passes the check by default.

---

Exploit

1. Leave the password field blank
2. Hit Submit

That's it.

---

Root Cause

No null/empty check on the loaded password value. Missing file → empty/null comparison → blank input matches.

---

Key Takeaway

Always validate that required files and secrets actually exist before running comparison logic. A missing file should trigger an error, not a silent pass.