> For the complete documentation index, see [llms.txt](https://the-winrars.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://the-winrars.gitbook.io/writeups/2020-writeups/ractf/web/finding-server-information.md).

# Finding Server Information

We are given the name of the source code file `app.py`, and we need to find a way to read it.

We already have access to the admin section of the site from the previous challenge.

We are given links to three available videos that we can watch.

These all follow the format `/watch/XXXX.mp4`.

We are told the name of the file we need to read is called `app.py`

So we can try `/watch/app.py`.

In the source code of the page, we can see:

`data:video/mp4;base64,ractf{qu3ry5tr1ng_m4n1pul4ti0n}`

## Flag: ractf{qu3ry5tr1ng\_m4n1pul4ti0n}