THM Hacker Holidays Day 2 — Room 404 Walkthrough

We can verify that the web app is running on the port 8080.

Since the app mentions "room that isn't mentioned on the floor plan", I got the idea to FUZZ for directories not listed on the app.

We verified the /.git/ endpoint.

I used git-dumper to dump the git repository. After dumping, we changed our working directory to the output directory (i.e room-404)

Upon checking git log, we got the flag

Flag: THM{byt3_l0tus_n3v3r_f0rg3ts}