Beta

This catalog is a work in progress — I'm actively polishing it and adding new labs.

0xBugLabs
← All labs
EasyRecon / OSINT

Acme Attack Surface — mapping what's actually reachable

Acme Corp's public marketing site, exactly as it ships. No login form to attack, no input field to fuzz — just a website, and the question of what else is sitting around it that nobody meant to leave reachable.

Node.jsExpressDocker Compose (2 services)

Run it locally

git clone https://github.com/G3kSec/0xBugLabs.git
cd 0xBugLabs/labs/recon/acme-attack-surface
docker compose up -d

The app is at http://localhost:8084. Tear down with docker compose down.

Objectives (2)

  1. 01

    Find what robots.txt was trying to hide

    A disallow rule is a request crawlers honor, not a lock. Something is being kept out of search results — and it's still sitting in the webroot for anyone who asks for it directly.

    ▸Hints (2) — stuck? optional, no spoilers
    1. 1.Check /robots.txt. A disallow rule tells you exactly what someone wanted hidden from search engines — not from you.
    2. 2.Request the disallowed path directly, then guess a plausible backup filename inside it (think: a dated database export).
  2. 02

    Find the second host nothing on the site links to

    Somewhere in what you can already reach is a reference to infrastructure that was supposed to be gone by now. Follow it.

    ▸Hints (2) — stuck? optional, no spoilers
    1. 1.robots.txt disallows a second path too. What commonly ends up exposed there by accident in a real deploy?
    2. 2.A git remote URL can point at infrastructure nobody meant to advertise. Follow wherever it points.
reconosintcontent-discoveryasset-discoveryinformation-disclosure
View lab source →Solution walkthrough (spoilers) →