Hacker Holidays — Day 2: What I Learned from “Room 404”

Today, I completed Day 2 of the Hacker Holidays event on TryHackMe. The room, Room 404, taught me an important web security concept called Exposed Git Repositories.

The room was beginner-friendly, but it showed how a small mistake in a web application can expose sensitive information like source code. In this article, I'm sharing what I learned from the room without including any walkthroughs, flags, or solutions.

About the Room

Platform: TryHackMe

Event: Hacker Holidays

Day: 2

Room: Room 404

Difficulty: Very Easy

Category: Web Security

Topics: Directory Enumeration, Git Exposure

Link: https://tryhackme.com/room/hh-room404-804573bf

Room Story

The room is based on The Byte Lotus Hotel, where something unusual is happening on the hotel's website. Some files and resources are hidden, but not everything is properly protected.

The goal is to explore the website carefully and find information that should not be publicly available.

This room shows that sometimes a simple mistake can create a serious security issue.

What is an Exposed Git Repository?

Git is a version control system that developers use to manage their source code.

Sometimes, developers accidentally leave the .git folder accessible on a live website. If that happens, attackers may be able to recover source code, configuration files, or the project's history.

This information can help attackers understand how the application works and may lead to finding more vulnerabilities.

Steps I Followed

To complete this room, I followed a simple and structured approach:

Explored the website to understand how the application was working.
Performed directory enumeration to look for hidden files and directories.
Identified an exposed Git repository that should not have been publicly accessible.
Reviewed the available source code to understand the application's structure.
Analyzed the security issue and learned why exposing a Git repository is a serious risk.
Completed the challenge after understanding the concept and applying what I had learned.

What I Learned

From this room, I learned that:

Directory enumeration can help find hidden files and folders.
Sensitive development files should never be publicly accessible.
An exposed Git repository can leak source code and project history.
Small configuration mistakes can become serious security problems.
Proper deployment is just as important as writing secure code.

Why This Matters

Many modern web applications use Git during development.

If developers accidentally expose the .git directory after deployment, attackers may gain access to information that was never meant to be public.

This room reminded me that protecting source code is an important part of web security.

My Daily Takeaway

Today's room taught me that web security is not always about finding complicated vulnerabilities.

Sometimes, simple enumeration and careful observation are enough to discover sensitive information.

It also reminded me that even small mistakes can have a big security impact.

Final Thoughts

I really enjoyed completing Day 2 of the Hacker Holidays event.

Even though the room was short and beginner-friendly, it taught me a practical web security concept that is useful in real-world security testing.

I'm excited to continue the event and learn something new from the upcoming rooms.

Disclaimer

This article only shares what I learned from the room. It does not include walkthroughs, flags, recovered source code, commands, or challenge solutions.