Secrets committed to an exposed .git
25 points · about 45 minutes · flag formatDC{...}Brief
Information disclosure is the application handing out something it should have kept — a stack trace naming internal paths, a comment holding a key, a debug endpoint, a backup file left in the web root, a verbose error that confirms what an attacker guessed.
This lab: Secrets committed to an exposed .git. Find the secret the application leaks without meaning to.
Work it against your own copy of the target. When you have the flag, submit it below.
Objective
Find where the application says more than it should, and read the secret it leaks. Capture the flag hidden in what it exposes.
Sign in and join the Academy to submit a flag, take hints and track your progress.
Sign inWalkthrough
Locked until you solve it — or reveal it above, which forfeits the points. 3 hints available before then.