Magic Link 1

Platform: Bluehens | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-20 | Status: Solved Techniques: robots_txt_enumeration, env_file_disclosure

Summary

Task: a Magic Link Login Service with hidden paths revealed in robots.txt. Solution: enumerate disallowed paths from robots.txt, access exposed /.env file to retrieve leaked credentials and flag.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: bluehens | ID: 20260420_bluehens_magic_link_1
• Tags: information_disclosure, env_file, robots_txt, sensitive_data_exposure
• Indicators: robots.txt with Disallow entries, /.env accessible, magic link login service, token in environment variables
• Source: 20260420_bluehens_magic_link_1.md

Foothold

Vulnerability / Misconfiguration

1. robots_txt_enumeration
2. env_file_disclosure

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• robots_txt_enumeration
• env_file_disclosure
• Tags: information_disclosure, env_file, robots_txt, sensitive_data_exposure

Original Writeup

<details><summary>Click to expand original content</summary>

Magic Link 1 — bluehens

Description

Magic Link Login Service at https://bluehens-magic-link.chals.io

A simple web application offering magic link authentication. The goal is to find the flag hidden somewhere in the application.

Analysis

Initial Recon

The main page (/) presented a simple Magic Link Login Service interface. Standard recon revealed a robots.txt file with interesting disallowed paths:

User-agent: *
Disallow: /inbox
Disallow: /dashboard
Disallow: /.env

The presence of /.env in the disallowed list is a major red flag — it suggests the environment file might be publicly accessible despite the robots.txt directive (which only instructs crawlers, not enforces access control).

The Vulnerability

The /.env file was directly accessible without authentication. This is a classic misconfiguration where sensitive configuration files are deployed to production and served by the web server.

Solution

1. Check robots.txt for hidden paths:

    bash read-only • copy allowed Copy
   curl https://bluehens-magic-link.chals.io/robots.txt

2. Access the exposed .env file:

    bash read-only • copy allowed Copy
   curl https://bluehens-magic-link.chals.io/.env

3. Retrieved contents:

   TEDDYS_EMAIL=teddy@udctf.com
   TEDDYS_TOKEN=udctf{REDACTED}
   ADMIN_EMAIL=admin@udctf.com
   INBOX_URL=http://localhost:5050/inbox?token=${TEDDYS_TOKEN}
   

The flag was directly exposed as TEDDYS_TOKEN in the environment file.

Red Herrings

The /inbox and /dashboard paths mentioned in robots.txt were potential rabbit holes. Once the .env leak was discovered, there was no need to explore authentication bypass or inbox exploitation — the flag was already in hand.

Lessons Learned

1. robots.txt is not access control — it's a suggestion for crawlers, not a security mechanism
2. Always check for common sensitive files: /.env, /.git/config, /config.php, /wp-config.php.bak
3. Environment files should never be in the web root — use proper deployment practices
4. The flag itself is a hint: REDACTED = "don't host your env file"

</details>

---

signed by XESXOR