webProeasy
Magic Link 2
bluehensctf
Task: a Magic Link Login Service with hidden endpoints revealed by robots.txt, including an exposed .env file. Solution: enumerate via robots.txt, access /.env to leak TEDDYS_TOKEN, use the token to access /inbox and retrieve the flag from Teddy's inbox.
$ ls tags/ techniques/
robots_txt_enumerationenv_file_accesstoken_reuseinbox_access_via_leaked_token
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][free]Magic Link 1— bluehens
- [web][Pro]Magic Link 3— bluehensctf
- [misc][Pro]Prompt Easy— BlueHens CTF 2026
- [pentest][free]Interpreter (Mirth Connect → f-string Injection)— hackthebox
- [web][free]Flag Command— hackthebox