Illumination

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

A Junior Developer just switched to a new source control platform. Can you find the secret token?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the file given, then jump to the extracted folder.

2. Looks like there's a hidden folder, go to that folder.

3. Based from the description, they want us to find the secret token.

4. The .git folder holds all the history changes.

5. Let's run git at this folder -> git log.

6. Notice at this commit.

7. Sherlock removed the token.

8. To see what's removed we can run git show 47241a47f62ada864ec74bd6dedc4d33f4374699.

9. Based from the string's postfix, we can conclude that the text is encoded in base64.

10. Let's decode it!

11. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.