Know your target
Profile the target before attacking it. Capture its response headers to a file, work out what language it's built in, and report exactly which server software it runs.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
You now know the target is a Werkzeug/Python app — the development server behind Flask. That single fact tells you the language, hints that this may be a dev server left exposed, and shapes every payload you try next. Fingerprinting first is what separates a methodical tester from someone throwing random exploits.
Show solution
cd /home/student
curl -sI http://127.0.0.1:8080/ -o headers.txt
cat headers.txt