Loading
MetroRide just launched a new public website, and the marketing team is proud of it. The security team is less proud: they suspect the site leaks information through files meant for search engines.
The robots.txt file tells search crawlers which paths to avoid. The problem is that attackers read it too, because it is a free list of interesting paths. Anything secret must never be listed there.
What you are given: the site's robots.txt and its sitemap.xml, below. All names and domains are fictional.
What to find: one disallowed path is not a normal word. It looks encoded. Decode it, then build the flag as the letters MXC, an opening brace, the decoded text, and a closing brace.
The sitemap.xml is mostly a decoy, but read it anyway. Good investigators check everything.
robots.txt:
User-agent: *
Disallow: /admin/
Disallow: /backup-2024/
Disallow: /cm9ib3RzX3RvbGRfZXZlcnlvbmVfeTNvaA/
Disallow: /tmp/
Allow: /
Sitemap: https://portal.metroride.example/sitemap.xml
sitemap.xml:
<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url><loc>https://portal.metroride.example/</loc></url>
<url><loc>https://portal.metroride.example/routes</loc></url>
<url><loc>https://portal.metroride.example/fares</loc></url>
<url><loc>https://portal.metroride.example/contact</loc></url>
</urlset>
Submit the flag when you have it.
This challenge only. All names, addresses and data are fictional. Do not test any real system.
Stuck? Open hints in order: a nudge, then the next step, then an explicit pointer. Costs are taken from this solve's points.
Sign in to open hints.
Sign in to submit a flag.
Sign in, then solve this challenge or give up on it to read write-ups.