hacker.org

For me, the whole there-is-an-image-hidden thing was pretty clear right from the beginning, as soon as I had discovered the imagecolorat() warning. Some of the printed values looked like they could be RGB parts (i.e., between 0 and 255), so extracting the image was my first guess. On the other hand,...

Actually, brute-force works quite well, since the changed byte is at the beginning of the file. I used Python and the Pillow library which is really great for anything image-related: import io from PIL import Image def fixit(): byts = open('BrokenImage.png', 'rb').read() for i in range(0, len(byts))...

I had exactly the same idea as Roogley. Since all three challenges are on the same database server, you can simply retrieve the password from one of the former challenges. sqlmap makes that ridiculously easy.

I used http://sqlmap.org/. It really is gold.

Using the jquery-injector extension for Chrome, you can just do
in the console.

Compiling and executing the code gives you '3.156'. Then, it's easy to guess