Challenge

A vault that takes a password. The comparison bails out at the first wrong character, so a correct prefix takes measurably longer to reject than a wrong one.

Approach

That early exit is a timing side channel. For each position, try every candidate character and keep the one whose response is consistently slower, since that means the server got further into the comparison before failing. Burp testing confirmed the leak, and the first four characters came out as H8iO.

Solution

Walk the password position by position, measuring response time per guess. Burp Intruder with a request-timing column finishes the job once the pattern is clear.

Flag

K17{aLL_iN_go0d_t1m3}