Hints : British Biscuit = Cookie.I try username=admin & password=admin, login success but it gives me that this is a limited user. Let check cookie:r - 351e766803d63c7ede8cb1e1c8db5e51c63fd47cffu - 351e76680321232f297a57a5a743894a0e4a801fc3we have similar string in both cookie : "351e766803". Put it away we will have a md5 string r - d63c7ede8cb1e1c8db5e51c63fd47cff = limitedu - 21232f297a57a5a743894a0e4a801fc3 = adminChange the cookie value r into md5(admin) and yup :Congratulations! The flag is: bb6df1e39bd297a47ed0eeaea9cac7ee