I need help with the exercise:
Try to download the contracts of the first 20 employee, one of which should contain the flag, which you can read with ‘cat’. You can either calculate the ‘contract’ parameter value, or calculate the ‘.pdf’ file name directly.
I tried using Burp’s Decoder to try 1 to 20 numbers but I was unsuccessful. Reading the source code we can see that the value is first getting base64 encoded and then URL encoded. I was not able to create a curl command to generate the right encoded values for the numbers 1 to 20.
Any help would be greatly appreciated.