In HTML source code:
<span><script type="text/javascript" src="main.js"></span><span></script>
</span>In main.js:

<span> if (password == "53cure" && username=="@[email protected]") {
alert("Awesome!");
window.open("secureflag.html");
} else {
alert("Oh swap!You are close. Why cant you try again?");

}
As it says, if I give @[email protected] as username, and 53cure as password, it redirects to a jpeg file, and it has flag near file's end, as binary.
</span>