##  fsociety 
Always check robots.txthttp://web.zh3r0.ml:6565/robots.txt```# F-SocietyUser-agent: *Disallow: /elliot.html```
visit elliot.html, see large gif, check sourcehttp://web.zh3r0.ml:6565/elliot.html```html```
Seems like we should check out the js on the page.```html<script src="myscript.js">```
http://web.zh3r0.ml:6565/myscript.js```js(![]+[])[+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(+[![]]+[+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+[+!+[]]+[+[]]+[+[]]+[+[]])])[+!+[]+[+[]]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]```is JSFuck and decodes into `fsocietyislit`, interesting let's take note of that and keep searching.
After more dirbusting we found /code and subsequently flag.php.We're met with:
`Elliot need to submit hash here to get the flag.`
Guessed that the parameter was code and submitted md5 of the string we found earlier.
```bashcurl "http://web.zh3r0.ml:6565/code/flag.php" --data "code=46a07f610bdab202d6b83d78a5d72914"
zh3r0{ell1ot_y0u_4r3_1n}```