This is an easy-rated room featuring a web challenge.

Initial Hints

Find what’s hidden deep inside this website.

Web Server

Checking into the requests of the site, we see that we have the following server running:

Werkzeug/3.1.5 Python/3.10.12

This means we have a Flask server running on the machine. But nothing interesting in the source code so far.

Ffuf Scan

After running a directory scan, we see that the robots.txtfile is accessible to us, and we have some findings.

root@ip-10-80-117-157:~# ffuf -u <http://10.80.161.128:5000/FUZZ> -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt 

        /'___\\  /'___\\           /'___\\       
       /\\ \\__/ /\\ \\__/  __  __  /\\ \\__/       
       \\ \\ ,__\\\\ \\ ,__\\/\\ \\/\\ \\ \\ \\ ,__\\      
        \\ \\ \\_/ \\ \\ \\_/\\ \\ \\_\\ \\ \\ \\ \\_/      
         \\ \\_\\   \\ \\_\\  \\ \\____/  \\ \\_\\…