DevWEB/flag.php

<?php
session_start();
if (!isset($_SESSION['admin'])) {
    http_response_code(403);
    die("Access denied");
}

echo getenv('FLAG');