diff --git a/Images/admin_login.mp4 b/Images/admin_login.mp4
new file mode 100644
index 0000000..c07e5f0
Binary files /dev/null and b/Images/admin_login.mp4 differ
diff --git a/Images/input.png b/Images/input.png
new file mode 100644
index 0000000..917774f
Binary files /dev/null and b/Images/input.png differ
diff --git a/Images/login_attempt.mp4 b/Images/login_attempt.mp4
new file mode 100644
index 0000000..ba886e8
Binary files /dev/null and b/Images/login_attempt.mp4 differ
diff --git a/Images/login_portal.png b/Images/login_portal.png
new file mode 100644
index 0000000..fbc3cd8
Binary files /dev/null and b/Images/login_portal.png differ
diff --git a/Images/path_flag.png b/Images/path_flag.png
new file mode 100644
index 0000000..9ce000b
Binary files /dev/null and b/Images/path_flag.png differ
diff --git a/Phase 2/03 Web Exploitation.md b/Phase 2/03 Web Exploitation.md
index 65a096c..48d299d 100644
--- a/Phase 2/03 Web Exploitation.md	
+++ b/Phase 2/03 Web Exploitation.md	
@@ -2,4 +2,48 @@
 
 # Forbidden Paths
 
+**Flag:** `picoCTF{7h3_p47h_70_5ucc355_e5a6fcbc}`
+
+Here, the flag is given in the file `/flag.txt`, but absolute paths are not allowed to be entered. We know an nginx website is stored at `/usr/share/nginx/html/`, so we use relative file paths to traverse to the file.
+
+![The input](../Images/input.png)
+
+Since we are four levels deep in the root directory, we use `../` four times.
+
+![The flag](../Images/path_flag.png)
+
+So the flag turns out to be `picoCTF{7h3_p47h_70_5ucc355_e5a6fcbc}`.
+
 # Local Authority
+
+**Flag:** `picoCTF{j5_15_7r4n5p4r3n7_05df90c8}`
+
+We are given a website `http://saturn.picoctf.net:50920/`, which opens to a login page.
+
+![Portal](../Images/login_portal.png)
+
+We open our browser's network tab and enter meaningless data in the input fields. After that we open the request titled `secure.js` and go into its *Response* tab.
+
+![Login request](../Images/login_attempt.mp4)
+
+We find the following (very insecure!) JavaScript code that checks whether the username and password are that of the admin's or not
+
+```
+function checkPassword(username, password)
+{
+  if( username === 'admin' && password === 'strongPassword098765' )
+  {
+    return true;
+  }
+  else
+  {
+    return false;
+  }
+}
+```
+
+Therefore, the username we need is `admin` and the password `strongPassword098765`. Using these details, we successfully log in and acquire the flag.
+
+![Admin login](../Images/admin_login.mp4)
+
+