Ask the Robots
Easy 10 ptsA site owner did not want search engines indexing their admin area, so they listed
it in robots.txt — a file that is, by design, world-readable. They told every crawler,
and every attacker, exactly where not to look. The hidden path is the flag.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
Read the artifact top to bottom. It is a plain text file served from /robots.txt.
Hint 2
A Disallow line names a path nobody was meant to find. That path is the flag.
Hint 3
The flag is the last path segment — the part that looks like nm{...}.
The artifact
GET https://shop.example/robots.txt
HTTP/1.1 200 OK
Content-Type: text/plain
User-agent: *
Disallow: /assets/
Disallow: /cart/
Disallow: /internal/backup-2025/
Disallow: /admin-nm{disallow_is_not_deny}/
Sitemap: https://shop.example/sitemap.xml