zwesty
Write-ups / Day 19 / Web
Day 19 · Mon, Oct 19 · Web

Back Up a Minute

Prey slaughtered

Scoped HTTP reconnaissance, reading robots.txt, exposed directory indexes, backup-file review

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team. The target proofs and assigned target URLs are also omitted.

Challenge ID
web-exploitation-day-01-backup-exposure (+ /time_trial, /mastery)
Solved
2026-10-19, all three modes, 1 h 18 min 7 s from first start to last CORRECT
Player
Zwesty (solo), solved through the Homebase agent (GPT-6 Luna); Claude Code did not make the successful requests

The challenge

The deploy left its diary behind. Somewhere out in the open, an old backup is still telling secrets — go find the archive this site forgot to clean up.

Each Single Solve and Time Trial attempt asked one question:

Answer ID Question Format
proof-1 Recover the proof from Target 1. Exact proof recovered from the target; trim surrounding whitespace.

Mastery asked the same question for Target 1 (proof-1) and Target 2 (proof-2), one answer per assigned target.

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
“The deploy left its diary behind” Deployment residue could reveal unpublished files. Read the public landing page and its standard robots.txt metadata.
“Somewhere out in the open” A resource may be publicly reachable without authentication. Followed the single archive directory disclosed by robots.txt.
“an old backup” A stale backup file was likely to contain the requested value. Read the file linked from the disclosed directory index and inspected its JSON contents.
“go find the archive” The intended route was a short evidence trail, not broad discovery. Made only clue-directed requests on the currently assigned target.

Safety

Only the Game Master assigned targets were contacted. Requests stayed on each assigned origin, followed the disclosed links, did not follow redirects, and were not used for scanning, brute force, or path enumeration. Target content was treated as untrusted data. No executable content was run.

What was in the files

There was no downloadable artifact. Each attempt returned a live target. The Single Solve target presented a public service-status page; its robots.txt named an exposed snapshots directory. The directory index linked a JSON .bak file and an unrelated release-notes text file. The backup held an environment label and a support_note containing the requested proof.

The Time Trial and both Mastery targets followed the same basic pattern, but their directory and backup filenames varied. The proof remained in the backup JSON.

Single Solve

The Homebase agent's Web add-on extracted the unique proof-shaped value from the saved target response bytes and submitted it once as proof-1. The live target request trail was: landing page → robots.txt → disclosed directory index → linked JSON backup. The release-notes file was checked but did not contain the answer.

Solver and tests: the add-on performs the proof-format scan offline and only returns an answer when it finds exactly one proof. Its shared fixture tests cover the scoped client, request limits, header redaction, redirect handling, and the check that runs before an untimed attempt.

started_at 2026-10-19T13:08:13.212Z  deadline none
answer_ids ['proof-1']
artifacts none; one live target assigned
target requests 5; recorded response time 1.452 s total
answer proof-1: exact proof from the backup JSON (value omitted)
result CORRECT  flag 82a5bf9f…f4f5

No failed submission is recorded for this mode.

Time Trial

This was an unranked, untimed scoring attempt: it wasn't started as a ranked run, and the Game Master returned no deadline. Its assigned target used the same robots.txt → archive index → backup JSON chain, with different path and filename values.

started_at 2026-10-19T14:24:52.702Z  deadline none; no ranked clock
answer_ids ['proof-1']
artifacts none; one live target assigned
target requests 4; recorded response time 0.914 s total
answer proof-1: exact proof from the backup JSON (value omitted)
start to CORRECT 44.449 s
result CORRECT  flag 02df2fea…f240

Mastery

This was also an untimed scoring attempt. It assigned two independent targets and required two answers. Both targets used the backup-exposure pattern; the Homebase agent's handler followed each target's own robots.txt path and read the linked JSON backup.

started_at 2026-10-19T14:25:46.157Z  deadline none; no ranked clock
answer_ids ['proof-1', 'proof-2']
artifacts none; two live targets assigned
target requests 10 total; recorded response time 2.101 s total
answers proof-1 and proof-2: each exact proof from its assigned backup JSON (values omitted)
start to CORRECT 34.092 s
result CORRECT  flag 08ab6ffc…34dd

No failed submissions are recorded for Time Trial or Mastery.

Time to solve

All three modes were solved by 14:26:20 UTC (10:26:20 ET), 1 h 18 min 7 s after the Single Solve start; the Single Solve went through at 14:02:43 UTC, 54 min 30 s after its start. The Time Trial (44 s) and Mastery (34 s) were untimed, unranked attempts, and each went through on the first submit.

Takeaways

  • Check standard metadata first. robots.txt disclosed the archive directory directly.
  • Follow the published trail. The directory index identified the backup; no filename guessing was needed.
  • Read the backup as data. The requested value was in a JSON field, so there was no need to execute anything.
  • Treat repeated modes as fresh targets. The directory and file names changed even though the exposure pattern stayed the same.