Since there was nothing interesting, the first thing I tried to do was inspect the page source, and inside it, I found the first part of the flag. So, let’s move on to the exploitation.
🎯 Solution Path
Exploitation Steps
Initial setup
After finding the first part of the flag, I decided to continue inspecting the page more thoroughly.
Exploitation
By trying to check the files included in the page source of index, I found /mycss.css, and after opening it, I found the second part of the flag. Then, since there was nothing else, I tried running Gobuster:
Gobuster
By performing a fuzzing of common files, I found /robots.txt. After trying to access it, I found the third part of the flag along with a hint, which indicated that it was an Apache server. So, I took the second result from Gobuster, /.htaccess, and inside it, I found the fourth part of the flag and another clue mentioning Store. Finally, by accessing the third result from Gobuster, /.DS_Store, I found the fifth and final part of the flag. I then combined all the parts to obtain the complete flag.
Flag capture
Manual Flag 1Manual Flag 2Manual Flag 3Manual Flag 4Manual Flag 5
🛠️ Exploitation Process
Approach
The exploit retrieves each part of the flag by making a request and extracting it using a regex, then finally combines all the parts to form the complete flag.
