Solving TryHackMe “Room 404”: Exposed .git Folder & Source Code Leak Walkthrough

The Challenge

In TryHackMe's Room 404 challenge, we are given a web application running on port 8080 for a hotel called Byte Lotus.

Our goal is simple: find the hidden room and get the secret flag string.

Step 1: Checking the Website Source Code

First, I opened the website in my browser ([[http://10.48.178.164:8080](http://10.48.178.164:8080)).](http://10.48.178.164:8080](http://10.48.178.164:8080)`).)

To see what's happening behind the scenes, I right-clicked on the webpage and selected View Page Source(this shows you the hidden HTML code that builds the website).

At the bottom of the code, I noticed this line:

htmlguest experience platform · build staging

Why this matters: "Staging" means a test version of a website. Developers often leave notes, temporary passwords, or test files on staging sites by accident.

Step 2: Searching for Hidden Folders

Since there were no obvious links to hidden pages on the main screen, I used a security tool called Gobuster.

Gobuster works like an automated guesser: it tests thousands of common folder names (like /admin, /secret, or /backup) to see if any of them exist on the website.

bash gobuster dir -u http://10.48.178.164:8080/ -w /usr/share/wordlists/dirb/common.txt

After running for a few seconds, it found something:

text/.git/HEAD (Status: 200)

What does "Status: 200" mean?

When your browser asks a website for a page, the website sends back a 3-digit number called a Status Code:

404 Not Found: The page doesn't exist. 200 OK: Success! The page or file actually exists and was loaded successfully.

So seeing Status: 200 on /.git/HEAD meant the developer accidentally left their hidden .git folder open to the public!

Step 3: What is a .git folder?

A .git folder is what developers use to track changes to their code. It stores the full history of every update ever made to the website.

Because it was left unprotected, I used a command-line tool (wget) to download the entire hidden folder to my machine:

bash mkdir repo && cd repo wget -r -np -nH — cut-dirs=1 http://10.48.178.164:8080/.git/

Step 4: Finding the Flag in History

Even if a developer deletes a secret or password from the main website, Git remembers everything that was previously saved in older updates.

To read through the developer's past updates and edits, I ran:

bash git log -p

Scrolling through the history, I found where the developer first created the website's README.md file:

diff +# Byte Lotus — Guest Experience Platform +Internal staging repository for the guest app… +Staging flag (remove before launch): THM{byt3_l0tus_n3v3r_f0rg3ts}

The developer left the flag inside a developer note in their very first update!

Summary & What I Learned

1. 200 OK means a file exists: Always look for 200 responses when searching for hidden directories.
2. Never leave .git folders public: Web developers should block access to hidden system folders so strangers can't download their code history.
3. Git history holds secrets: Deleting a password or flag from a website isn't enough if it's still saved in past Git commits.