# CTF Challenge: Web Exploitation

---

Table of contents:

* Introduction to challenge and description
    
* Solution walkthrough
    
* Conclusion
    

---

Event: BUG BOUNTY BLITZ

Challenge Name: Forbidden Path

Category: Web Exploitation

Points: 150

---

Introduction:

A web exploitation Capture The Flag (CTF) challenge is a cybersecurity competition exercise where participants must identify and exploit security vulnerabilities in a purposefully vulnerable web application to find a hidden piece of information, known as a "flag".

It tests practical skills in areas like reconnaissance, input testing, and exploiting common flaws such as SQL injection, XSS, or file inclusion, providing a safe way to learn real-world web security concepts.

---

Description of the challenge:

*Some paths are meant to be invisible, written only for eyes that wander where the world does not. A quiet list sleeps in the shadows of the site — the guide to what should stay hidden waits at the very root, and you might uncover a line never meant to be seen.*

---

**Solution Walkthrough**

**Step 1: Reading the description**

The challenge description hinted that something *hidden within the site’s structure* would lead to the flag — a clear sign that this was a web directory problem.

Key clue: *“A quiet list sleeps in the shadows of the site”* — “quiet list” is often the robots.txt file, which lists directories that search engines shouldn’t index.

---

**Step 2: Checking robots.txt**

At the website root, after opening:  [https://acmpdeu.encodepdeu.space/robots.txt](https://acmpdeu.encodepdeu.space/robots.txt)

This file showed several “Disallow” paths:

User-agent: \*

Allow: /public/

Disallow: /admin/

Disallow: /n0t\_s0\_s3cr3t/

Disallow: /thisisnotimportant/

This revealed a suspicious directory:  
/n0t\_s0\_s3cr3t/

---

**Step 3: Exploring the hidden directory**

Visiting that directory revealed a riddle:

[https://acmpdeu.encodepdeu.space/n0t\_s0\_s3cr3t/](https://acmpdeu.encodepdeu.space/n0t_s0_s3cr3t/)

Riddle:

*"This place is only an echo — a mirror of the path you seek. The token in the address is wearing a costume; stop the dance of its letters in the URL, watch the way they twist and turn. Let some rest quietly, while others stand tall — only when the rhythm is right will the hidden path awakens."*

The riddle clearly referenced the directory name itself — saying it’s *“wearing a costume”*, meaning it’s encoded.

---

**Step 4: Decoding the disguised token**

The directory name n0t\_s0\_s3cr3t looked a bit different so by replacing the numbers with similar-looking letters we’ll check if it’s a possible solution.

* 0 → o
    
* 3 → e
    

So:

‘n0t\_s0\_s3cr3t’ changes to → ‘not\_so\_secret’

The phrase *“stop the dance of its letters”* hinted at removing unnecessary characters so I removed the underscores and the resulting text was:

‘notsosecret’

---

**Step 5: Accessing the real hidden path**

Replacing the text in the url:

[https://acmpdeu.encodepdeu.space/not\_so\_secret](https://acmpdeu.encodepdeu.space/not_so_secret)

The flag was successfully found!

---

Step 6: Flag

FLAG{ NOT\_SO\_SECRET}

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762784664828/348d0bda-1493-47ca-a895-830b4f23c685.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762784702262/94588e98-e967-482b-a849-198661bbaf7e.png align="center")

---

Conclusion

The *Forbidden Path* challenge demonstrated how seemingly hidden or restricted areas of a website can still be discovered through careful observation and logical reasoning. By analyzing the challenge description, inspecting the `robots.txt` file, and decoding leet-speak patterns, I successfully uncovered the hidden directory and obtained the flag.

This challenge emphasized the importance of exploring beyond visible web pages and understanding how web crawlers and access restrictions work.