• Hey guys, I am V3n0mKai back again with the New CTF Writeup on the TryHackMe CTF called “Hidden Deep Into my Heart”.
• This CTF is of the web category and from the challenge statement it seems like we have to find something hidden directories in order to get the flag .

• Now here we have to first on the “Start Machine” and “Start the Attack Box”, after that we will be able to access the website .

• Now here in this we will first of all look for the basic endpoints, files and directory traversal and finding some hidden secrets.
• So we tried the following things :- robots.txt, sitemap.xml, source code analysis, basic developer tools inspection, trying the basic directories common names on the URL.
• Robots.txt :- A state policy file which is placed in the root directory of every web application and implements the REP [Robot Exclusion Protocol] which instructs all the web crawlers which URLs to crawl and which URLs not to so as to avoid being sensitive urls appearing in the web searches, decreasing the web traffic as no duplicate search results and etc .
• Also note the difference between the Crawling and Indexing. Crawling is that thew browser reads the contents of the page and then lists it on the search results and Indexing is just saving the metadata and the urls.
• But we have the X-Robot-Tag:noindex tag to ensure that the page is not indexed and also does not appear in the search results as well, but for this work the crawling for that page must allowed in the robots.txt because without that it index the page.
• Sitemap.xml :- It is the extra markup language file of the lists of the important urls of that web application and also the crawlers refer this file as well for the crawling output.
• Some of the common names of the directories we can try is like :- admin, login, admin-panel, robots.txt, sitemap.xml, secret, index.php and many more. We can also find this in my wordlists and also via github repositories as well.
• Now in the robots.txt we found one directory names as “cupids_secret_vault” and then when we traversed to that directory we got this .

• Now from here we tried the gobuster scanning on the both parts of the url that is first, normal ip url and then second, the one with directory found from the robots.txt also included as well. So started two scans on that.
• So before proceeding further we should first understand that what is actually the gobuster tool in detail and also see the most important flags we could use it to extract the information and do effective directory enumeration from that.
• Gobuster :- This tool for the directory and files enumeration across the web application by crafting the proper command with valid syntax and extracting any sensitive files from the web application as well. This tool is written in the go language.
• Gobuster is a concurrent brute-force engine written in Go. It: Takes a word, Injects it somewhere, Compares response, Filters output .
• Below diagrams images shows every important flags and options of the gobuster which we ca use enumeration process.

• Now as we have seen the gobuster command all the necessary so for the detecting the hidden directory enumeration we tried the below command .

gobuster dir -u http://10.49.155.99:5000/cupids_secret_vault/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 100

• As we can see that we have found /administrator directory in the scan 2 output. On navigating to the directory it was a login page .

• Now here we have to try bit of the brute force and some common techniques of the username and password.
• So we tried some of them and some basic SQL Injection Payloads like ‘ OR 1=1 — , ‘ AND 1=1 — , ‘ OR 1=2 — , ‘AND 1=2 — but it didn’t worked.
• Then we tried the combinations like :- admin & admin, admin & password, administrator & admin and etcetra. This also didn’t worked. Now we saw that we also found comment text in the robots.txt which was ‘cupid_arrow_2026!!!’.
• So keeping the username:admin and the password:cupid_arrow_2026!!!, we attempted and voila we found the flag.

Get Devansh Patel’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in