Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
A protected area is guarded by HTTP Basic Authentication, but the developer accidentally left the credentials in an HTML comment on the public page. Check the page source.
Check the page source (Ctrl+U or similar)
Look inside HTML comments `<!-- ... -->`
Try the credentials you find at the Basic Auth prompt