Try to bruteforce the admin user on the login page for this website.
For simplicity, your wordlist can be the first 10 strings inside rockyou.txt.
rockyou.txt
This page displays a flag only for the admin user.