𝗧𝗿𝘆𝗛𝗮𝗰𝗸𝗠𝗲 — 𝗥𝗼𝗼𝗺 𝟰𝟬𝟰 𝗪𝗿𝗶𝘁𝗲𝘂𝗽

𝗧𝗿𝘆𝗛𝗮𝗰𝗸𝗠𝗲 — 𝗥𝗼𝗼𝗺 𝟰𝟬𝟰 𝗪𝗿𝗶𝘁𝗲𝘂𝗽

The application is running on port 8080, and the goal is to find something that the website was not supposed to expose.

𝗥𝗼𝗼𝗺 𝗢𝘃𝗲𝗿𝘃𝗶𝗲𝘄

Room Name: Room 404 Platform: TryHackMe Difficulty: Very Easy Category: Web / Directory Enumeration

The challenge description gives us an important hint:

Port 8080 is open, and the rooms the application never lists are the ones worth finding.

So I started with enumeration.

𝗥𝗲𝗰𝗼𝗻𝗻𝗮𝗶𝘀𝘀𝗮𝗻𝗰𝗲

First, I scanned the target machine to identify the open ports and running services.

Command:

nmap -sC -sV 10.48.181.30

The important results were:

22/tcp open ssh 8080/tcp open http Werkzeug httpd 3.0.1

Nmap also detected something very interesting on port 8080:

http-git: 10.48.181.30:8080/.git/ Git repository found!

This immediately stood out.

The web server appeared to have an exposed .git directory.

𝗪𝗵𝘆 𝗶𝘀 𝘁𝗵𝗲 𝗚𝗶𝘁 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗜𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝘁?

Git repositories contain much more than the current website files.

A .git directory can contain:

• Previous commits • Deleted files • Configuration files • Developer changes • Old versions of source code • Sensitive information accidentally committed in the past

So even if the current website does not display something, the information may still exist inside the Git history.

𝗩𝗲𝗿𝗶𝗳𝘆𝗶𝗻𝗴 𝘁𝗵𝗲 𝗘𝘅𝗽𝗼𝘀𝗲𝗱 𝗥𝗲𝗽𝗼𝘀𝗶𝘁𝗼𝗿𝘆

Since Nmap identified the .git directory, I checked whether it was directly accessible through the web server.

Command:

curl http://10.48.181.30:8080/.git/

The server responded successfully, confirming that the .git directory was exposed.

At this point**, I knew that the Git** repository could potentially be downloaded and analyzed locally.

𝗗𝘂𝗺𝗽𝗶𝗻𝗴 𝘁𝗵𝗲 𝗚𝗶𝘁 𝗥𝗲𝗽𝗼𝘀𝗶𝘁𝗼𝗿𝘆

To recover the repository, I used git-dumper.

Initially, installing it directly with pip gave an externally-managed-environment error.

Instead of installing packages globally, I created a Python virtual environment.

Command:

python3 -m venv venv1

Then I activated it:

source venv1/bin/activate

After activating the virtual environment, I installed git-dumper:

python -m pip install — upgrade pip

python -m pip install git-dumper

𝗪𝗵𝗮𝘁 𝗶𝘀 𝗴𝗶𝘁-𝗱𝘂𝗺𝗽𝗲𝗿?

git-dumper is a tool used to recover a Git repository when the .git directory is exposed through a web server.

It downloads the available Git objects and repository metadata and reconstructs the repository locally.

𝗗𝘂𝗺𝗽 𝘁𝗵𝗲 𝗥𝗲𝗽𝗼𝘀𝗶𝘁𝗼𝗿𝘆

I then used git-dumper against the target:

git-dumper http://10.48.181.30:8080/ ./dump

The tool detected the exposed .git directory and started fetching the repository data.

After the process completed, the repository was available locally inside the dump directory.

I then moved into it:

cd dump

And checked the files:

ls

The directory contained:

app.js index.html README.md

Now we had access to the application's source code and Git repository history.

𝗔𝗻𝗮𝗹𝘆𝘇𝗶𝗻𝗴 𝘁𝗵𝗲 𝗚𝗶𝘁 𝗛𝗶𝘀𝘁𝗼𝗿𝘆

Simply checking the current files was not enough.

Since the challenge was about an exposed Git repository, I also checked the commit history.

I used:

git log -p -S "THM"

The -p option displays the actual changes introduced by each commit.

The -S option searches for commits where the specified string appears or disappears.

Here, I searched for:

THM

This is useful in CTFs because flags commonly contain the THM prefix.

The search revealed the initial commit and its patch.

𝗙𝗶𝗻𝗱𝗶𝗻𝗴 𝘁𝗵𝗲 𝗙𝗹𝗮𝗴

While reviewing the commit diff, I found that the README.md file contained a staging flag.

The important part was that the flag was not something the current web application needed to display.

It was stored inside the Git repository history.

This is the final flag for the room.

I am not writing the actual flag here so that readers can find it themselves.

𝗪𝗵𝘆 𝗪𝗮𝘀 𝗧𝗵𝗶𝘀 𝗣𝗼𝘀𝘀𝗶𝗯𝗹𝗲?

The main issue was that the application's .git directory was publicly accessible.

A developer may think that deleting a file from the current website is enough, but Git keeps historical versions of files and changes.

That means sensitive information can remain recoverable even after it has been removed from the latest version.

In this challenge, the exposed Git repository allowed us to reconstruct the repository and inspect its commit history.

𝗖𝗼𝗺𝗽𝗹𝗲𝘁𝗲 𝗔𝘁𝘁𝗮𝗰𝗸 𝗙𝗹𝗼𝘄

The complete process was:

Nmap Scan ↓ Port 8080 discovered ↓ Exposed .git detected ↓ .git verified ↓ git-dumper used ↓ Repository recovered ↓ Git history analyzed ↓ Sensitive information found ↓ Flag retrieved

𝗞𝗲𝘆 𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴𝘀

• Always enumerate open ports and services. • Pay attention to unusual directories and files. • A publicly accessible .git directory can expose an entire repository. • Git history may contain information that is no longer present in the current source code. • Deleted files are not necessarily gone from Git history. • Tools like git-dumper can help recover exposed repositories. • Source code and commit history should never be publicly accessible on production servers.

𝗙𝗶𝗻𝗮𝗹 𝗧𝗮𝗸𝗲𝗮𝘄𝗮𝘆

Room 404 looked like a simple web enumeration challenge, but the important clue was hidden in the Nmap results.

The exposed .git directory gave access to the application's Git repository.

After dumping the repository and analyzing its commit history, I was able to locate the sensitive information containing the flag.

The main lesson is simple:

𝗗𝗼 𝗻𝗼𝘁 𝗲𝘅𝗽𝗼𝘀𝗲 𝘆𝗼𝘂𝗿 .𝗴𝗶𝘁 𝗱𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗼𝗻 𝗮 𝗽𝘂𝗯𝗹𝗶𝗰 𝘄𝗲𝗯 𝘀𝗲𝗿𝘃𝗲𝗿.

𝗖𝗼𝗻𝗰𝗹𝘂𝘀𝗶𝗼𝗻

This was a great beginner-friendly challenge for understanding web enumeration and Git exposure.

The key steps were identifying port 8080, discovering the exposed .git directory, dumping the repository with git-dumper, and finally searching through the Git history.

It also shows why developers need to be careful about committing secrets or sensitive information to Git repositories.

📬 Stay Connected

If you found this helpful and want to learn more about web security, hands-on labs, feel free to follow me for upcoming posts.

✍️ Follow me for more cybersecurity write-ups

🔗 LinkedIn — codermayank https://www.linkedin.com/in/codermayank/

📸 Instagram — @mayhack_ http://instagram.com/mayhack_/

Tags: #BugBounty #EthicalHacking #CyberSecurity #TryHackMe #CTF #CaptureTheFlag #WebSecurity #DirectoryEnumeration #Git #GitSecurity #PenetrationTesting #InfoSec