In our browser window, let's pick Challenge 5 (gain access to /etc/passwd), change the algorithm to SHA-1, click save, and then click on test:
Well, I don't see much happening here. But that URL sure looks interesting. Check out the parameters visible to us (and, apparently, under our control): http://192.168.108.106/ctf/challenge5/index.php?algo=sha1&file=test&hash=dd03bd22af3a4a0253a66621bcb80631556b100e
Clearly, algo=sha1 is defining the algorithm we selected. But file=test and the hash field should be catching our attention, as it appears to be a message authentication code mechanism ...
