Magic Link 1

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: robots_txt_enumeration, env_file_disclosure

Summary

Walkthrough of the CUSTOM Web Magic Link 1. Task: a Magic Link Login Service with hidden paths revealed in robots.txt. Solution: enumerate disallowed paths from robots.txt, access exposed /.env file to retrieve leaked credentials and flag.

---

title: "Magic Link 1" id: 20260420_bluehens_magic_link_1 category: web difficulty: easy event: bluehens tags: ["information_disclosure", "env_file", "robots_txt", "sensitive_data_exposure"] techniques: ["robots_txt_enumeration", "env_file_disclosure"] tools: ["curl", "browser"] indicators: ["robots.txt with Disallow entries", "/.env accessible", "magic link login service", "token in environment variables"]

Magic Link 1 — bluehens

Description

Magic Link Login Service at https://bluehens-magic-link.chals.io

A simple web application offering magic link authentication. The goal is to find the flag hidden somewhere in the application.

Analysis

Initial Recon

The main page (/) presented a simple Magic Link Login Service interface. Standard recon revealed a robots.txt file with interesting disallowed paths:

User-agent: *
Disallow: /inbox
Disallow: /dashboard
Disallow: /.env

The presence of /.env in the disallowed list is a major red flag — it suggests the environment file might be publicly accessible despite the robots.txt directive (which only instructs crawlers, not enforces access control).

The Vulnerability

The /.env file was directly accessible without authentication. This is a classic misconfiguration where sensitive configuration files are deployed to production and served by the web server.

Solution

1. Check robots.txt for hidden paths:

    bash read-only • copy allowed Copy
   curl https://bluehens-magic-link.chals.io/robots.txt

2. Access the exposed .env file:

    bash read-only • copy allowed Copy
   curl https://bluehens-magic-link.chals.io/.env

3. Retrieved contents:

   TEDDYS_EMAIL=teddy@udctf.com
   TEDDYS_TOKEN=udctf{REDACTED}
   ADMIN_EMAIL=admin@udctf.com
   INBOX_URL=http://localhost:5050/inbox?token=${TEDDYS_TOKEN}
   

The flag was directly exposed as TEDDYS_TOKEN in the environment file.

Red Herrings

The /inbox and /dashboard paths mentioned in robots.txt were potential rabbit holes. Once the .env leak was discovered, there was no need to explore authentication bypass or inbox exploitation — the flag was already in hand.

Lessons Learned

1. robots.txt is not access control — it's a suggestion for crawlers, not a security mechanism
2. Always check for common sensitive files: /.env, /.git/config, /config.php, /wp-config.php.bak
3. Environment files should never be in the web root — use proper deployment practices
4. The flag itself is a hint: REDACTED = "don't host your env file"

Key Takeaways / Lessons

• Mastering robots_txt_enumeration, env_file_disclosure was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-20 • CUSTOM • Magic Link 1 • Difficulty: Easy