nullconCTF - web 2

THere is a hidden .git folder
You can use Git-tools (https://github.com/internetwache/GitTools) to download the .git folder and extract the files.

First dump the files using Dumper and then extract the files of each commit using Extractor. Both these tools are available in the above link.

Once you download the files and analyze them you can see an index.php file deleted and you can see its code as we extracted is using Extractor in the above step. 

URI: 3e90c63922fa145442bb58d18b62af6c21717fee/index.php

In the index.php the login validation function is as follows,
function checklogin($u,$p)
{
    if (($u) === "passwordisinrockyou" && crc32($p) == "550274426"){
        return true;
    }
}

username - passwordisinrockyou
password - 5pAVWV (Reverse crc32 - https://github.com/theonlypwner/crc32)

Enter these creds by visiting the above URI and you will get the flag.