miscProhard

Phantom 2

tamuctf

Task: GitHub repo with phantom/orphaned commit, no API leaks to discover SHA. Solution: Brute force 4-char hex SHA prefixes via GitHub web interface, then extract flag via Git Data API tree/blob traversal.

$ ls tags/ techniques/
gitgithubrate_limitingphantom_commitsdangling_commitsgit_data_apigithub_apisha_brute_force
github_phantom_commit_recoverygit_tree_traversalsha_prefix_brute_forcegithub_web_interface_enumerationasync_http_rate_limiting
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups