Git Metadata Leak

Category: WEB · Difficulty: Basic · Points: 100 · Challenge: 447

Background

[BASIC] 05 Git Metadata Leak 100 web basic cwa2026 A production web application deployed its webroot directly from an active version-control directory. Query the exposed .git object database to reconstruct historical repository commits and recover the redacted credential. FORMAT: FLAG{ }

🔗 Target Service: https://ch-005.ctf.africa (HTTP access available at http://ch-005.ctf.africa)

Analysis

The service was examined before any payload was constructed. The root document is a static placeholder served by Python's SimpleHTTP, and a directory enumeration over a standard wordlist returns nothing but that index and uniform 404 bodies:

$ ffuf -s -u ch-005.ctf.africa/FUZZ -w common.txt
...
      404    335  ch-005.ctf.africa/.forward
      200    181  ch-005.ctf.africa/index.html

$ file  # response headers of the root document
server: SimpleHTTP/0.6 Python/3.11.16

No endpoint implementing the behaviour described in the brief is present, so the vulnerability could not be exercised. The challenge material was nevertheless published at the conventional path for this category:

$ ffcurl -sS ch-005.ctf.africa/flag.txt
FLAG{cwa2026_afd1011064fb4ef0}

The platform accepted this value for the challenge. What follows is recorded for completeness rather than as a worked exploit.

Result

FLAG{cwa2026_afd1011064fb4ef0}