Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer
Web exploitationeasy100 pts0 solves

Hidden in Plain Sight

A training company mirrored its staging website to a ZIP file before launch. The developers swear nothing sensitive is reachable. Explore the mirror the way a crawler would.

Learning objectives

Understand what robots.txt does (and does not) protect; practise reading site files and decoding Base64.

Instructions

Download site-mirror.zip, extract it and inspect the files. No network access to any real site is needed.

Prerequisites: Basic comfort with a terminal or text editor.
Flag format: cspk{...}
Files: site-mirror.zip (0.9 KB) (download after registering)
Useful tools: CyberChef
Register to play

References

Write-up

The full write-up and learning takeaways unlock after you solve this challenge — spoilers stay hidden until then.

More web exploitation challenges

Predictable Reset Token