Difficulty: Very Easy

Category: Web / Information Disclosure

Target Room: https://tryhackme.com/room/hh-room404-804573bf

Executive Summary

During web application security assessments, misconfigurations in version control systems can lead to catastrophic source code disclosure. In this challenge, an exposed .git directory allowed us to reconstruct the target application's entire source code repository offline and extract sensitive internal staging notes.

Initial Reconnaissance & Thought Process

When spinning up the target machine on port 8080, the room description provided a vital clue:

“The Byte Lotus guest-experience platform went live in a hurry, and the night-shift developer shipped more than the website.”

1. The Automated Fuzzing Trap

My initial approach was running automated directory brute-forcing tools like dirsearch. While automated fuzzing is standard practice, wordlists can be large, slow, or noisy depending on the target's response times.

After spending time waiting on full directory scans, I paused to review the room’s core task hints:

• Directory Enumeration
• Dump the exposed source code

2. Manual Source Code Enumeration

Instead of waiting on deep wordlist fuzzing, I switched to manual testing for common source control folders that developers often forget to restrict access to:

• /.git/
• /.svn/
• /.env
• /.hg/

Navigating directly to http://<TARGET_IP>:8080/.git/ confirmed the vulnerability: Directory listing was enabled, revealing the internal Git repository structure.

Navigating Standard Git Objects

Browsing raw .git folders manually can be confusing at first because Git stores its repository data in compressed binary objects (zlib).

When inspecting files inside .git/HEAD, .git/refs/heads/main, or .git/objects/, you will often see raw SHA-1 hashes or compressed binary data rather than plaintext files:

$ file 13550b4cb13e9f30c61d5b342c532d21e45bda

13550b4cb13e9f30c61d5b342c532d21e45bda: zlib compressed data

$ file index

index: Git index, version 2, 3 entries

While you can manually decompress individual objects using Python’s zlib library or native git cat-file commands, doing this object-by-object across a web server is inefficient.

Exploitation: Reconstructing the Repository with git-dumper

To dump the full source code structure automatically, we use git-dumper—an automated tool that recursively fetches accessible Git internal files (index, HEAD, objects, refs) over HTTP and reconstructs a working local repository.

Step 1: Tool Execution

Execute git-dumper against the target's exposed .git/ endpoint:

python3 -m git_dumper http://<TARGET_IP>:8080/.git/ dumped_repo

(Or directly : git-dumper http://<TARGET_IP>:8080/.git/ dumped_repo)

Step 2: Source Code Analysis

Once git-dumper finishes downloading and extracting the objects, navigate into the output directory:

cd dumped_repo

ls -la

We can now see the entire reconstructed workspace:

• app.js — Front-end guest app JavaScript code.
• index.html — Main landing page interface.
• README.md — Internal staging documentation.

Retrieving the Flag

Checking the contents of README.md reveals internal notes left behind by the developer prior to staging:

cat README.md

# Byte Lotus — Guest Experience Platform

Internal staging repository for the guest app and concierge personalization
service. Do not deploy this folder to production.Staging flag (remove before launch): THM{************************}

Submit the Flag and earn a raffle ticket . The End . Happy Hacker’s Holiday