Vulnerability Overview
The flag was distributed across five separate files, each one hinting at the location of the next. The challenge demonstrates the range of files a web server can inadvertently expose — from developer comments in source code to server configuration files and OS metadata.
Exploitation Chain
| Step | File | Found |
|---|---|---|
| 1 | HTML source (Ctrl+U) | picoCTF{t |
| 2 | mycss.css | h4ts_4_l0 |
| 3 | myjs.js → hint to robots.txt | t_0f_pl4c |
| 4 | robots.txt → hint to .htaccess | 3s_2_lO0k |
| 5 | .htaccess → hint to .DS_Store | _9588550} |
Files Every Pentester Checks
| File | What It Can Reveal |
|---|---|
/robots.txt | Paths the site wants to hide from indexing — often exposes admin panels, staging endpoints |
/.htaccess | Apache directory configuration — can expose rewrites, authentication rules, allowed file types |
/.DS_Store | macOS directory metadata accidentally pushed to the server — can enumerate directory contents |
/.git/ | Full source code history if a git repo is deployed without excluding the .git folder |
Key Insight:
robots.txt is public. Listing a path under Disallow advertises it to anyone who reads the file — it does not restrict access. Server configuration files and OS metadata files accidentally committed to the web root are a real and common vulnerability. Always audit what files are deployed alongside application code.