First I get all the passwords, then I login as admin, change a value to become admin (it now says 'You are admin'), successfully spoof my refer, change grades by storing page and editing src (I get a red confirmation message, "grades have been changed"). I then change salary ('New salary has being set' ) and change admin pass by URL injection. The last step: I inject the c*n**ct page and get 'the hash is ###, you have now completedthis part of the mission'
But when I login to the folder, I get this:
You have not completed all the checkpoints.
GET .HTACCESS DETAILS
And wtf?! I've changed the grades, and I've obtained the .htaccess details! It should be completed now, shouldn't it?
Has _anyone_ got an idea? Or maybe even time to redo the challenge and see if it's broken? Have I missed something?