There is still a bit of inline CSS left, but that's generated by code.

Update: Wow! Can't believe I actually spent 20 minutes with Wireshark trying to reply with the actual TCP packets that were next in the handshake sequence.

Update 2: Finally solved it :) Pro-tip: keep it simple.

    #!/ova/fu -r

    HEY="uggc://jjj.jrroyl.pbz/jrroyl/choyvpOnpxraq.cuc?"
    QNGN="cbf=fbyirchmmyr"

    # Gvzrfgnzc nhgu
    GVZRFGNZC=$(phey -f -i -q $QNGN $HEY 2>&1 | terc "Qngr:" | phg -p 9- | ehol -egvzr -r "chgf Gvzr.cnefr($<.ernq).gb_v")

    # FLA-NPX nhgu
    QNGN+="&nhgu=$GVZRFGNZC&zft=FLA-NPX"
    ZQ5=$(phey -f -q $QNGN $HEY | rterc ^[n-s0-9]+)

    # ZQ5 penpx
    # (uggc://jjj.bcrajnyy.pbz/wbua/)
    ARKG=$(rpub $ZQ5 | ~/Qbjaybnqf/wbua-1.7.6-*/eha/wbua --sbezng=enj-ZQ5 /qri/fgqva --fubj | terc "?:" | phg -q ':' -s 2)
    QNGN+="&arkg=$ARKG"

    # Onfr64
    phey -f -q $QNGN $HEY | rterc ==$ | onfr64 --qrpbqr

    # ... bx, fb abj jr'er xvaqn purngvat.
    ZNTVP_AHZORE=$(phey -f "uggc://pqa1.jrroyl.pbz/yvoenevrf/fvtahc.wf?ohvyqgvzr=1289442390" | terc "ine o =" | rterc -b "[0-9]+")

    rpub gur_nafjre_vf_$(rpub "$ZNTVP_AHZORE * 2" | op)

It's not meant to be incredibly difficult, just fun and challenging enough to take 30 minutes or so.

Almost all of the solution in Haskell (except for the bit about extracting the actual answer from the Javascript); it's probably not what they intended, since the job is for a web-dev, but most of us here are probably just doing it for fun. I found the bit about guessing what string was hashed to make the MD5 the hardest, because it was basically just pure brute force (I didn't know what timezone it was in or what date format was used - so the hint wasn't very helpful).

    import Network.URI
    import Network.HTTP
    import Data.Maybe
    import Data.Time.Clock.POSIX
    import Data.Time.LocalTime.TimeZone.Olson
    import Data.Time.LocalTime.TimeZone.Series
    import Data.Time.Clock
    import Data.Time.LocalTime
    import Data.Time.Calendar
    import Text.Printf
    import Control.Monad
    import Codec.Binary.Base64.String

    main = do
      -- Is there a more portable way to do this?
      pdtTZS <- getTimeZoneSeriesFromOlsonFile "/usr/share/zoneinfo/America/Los_Angeles"
      pdtTime <- liftM (utcToLocalTime' pdtTZS) getCurrentTime
      let next = printf "w%02d%02d" ((\(_, _, d) -> d) . toGregorian . localDay $ pdtTime) (todHour $ localTimeOfDay pdtTime)
      ts <- getPOSIXTime
      let str = urlEncodeVars [("pos", "solvepuzzle"),
                               ("auth", show ts),
                               ("msg", "SYN/ACK"),
                               ("next", next)]
      r <- simpleHTTP (Request (fromJust $ parseURI "http://www.weebly.com/weebly/publicBackend.php")
                                  POST
                                  [Header HdrContentLength  (show $ length str),
                                   Header (HdrCustom "X-Requested-With") "XMLHttpRequest",
                                   Header (HdrCustom "X-Prototype-Version") "1.7_rc1",
                                   Header HdrContentType "application/x-www-form-urlencoded"]
                                  str
                      )
      case r
        of
          Left err -> print err
          Right b -> do
            putStrLn (decode . rspBody $ b)

Nice. :-)

Also, it's easier to just do the whole thing in firebug by rewriting the javascript on the page. The only thing I couldn't figure out was, what do you do when you get to 42?

[SPOILER: DON'T FOLLOW IF YOU WANT TO TRY IT YOURSELF FIRST]

http://yfrog.com/mto4sp

I'm not sure if this was the expected output, as there was no exact confirmation. But I assumed it was right.

ZXZhbHVhdGUgdGhlIGZvbGxvd2luZzogIGFsZXJ0KCdUaGUgc2VjcmV0IGNvZGUgaXM6ICcrYStkKyhjKyJfIikrKGIqMikpOwo== (This isn't the solution...)

which obviously tells me i got it wrong, not trying to apply for the position, just liked the puzzle, and i was curious about what other techniques are they, that don't require the GPU attack, or JtR which is priced at $180

You now need to decode the string that came back...

Nothing custom

I suppose it depends upon the password and the complexity. However my lowly GTX460 was cracking 600 million hashes a second.

Another poster mentioned yahoo -- the hash I drew (it changes hourly) was not on Yahoo, or Google, or rainbox table search engines. So that point is irrelevant (yes, of course the first check is search engines. But if it's not there you kind of have to move on). For the record, given that it changed, it was bb421ba20e679cc36ecae553c02cf948.

(NB: not trying to spoil the puzzle, just confused by the next step)