Westbrook Academy CTF Lab
Use GoBuster and manual inspection to discover hidden pages and capture flags across the Westbrook Academy website.
You are performing a simulated reconnaissance exercise against the Westbrook Academy website. Your goal is to use GoBuster and manual inspection techniques to discover hidden pages and capture flags planted throughout the site.
Each flag is in the format FLAG{...} and must be submitted at the flag submission portal.
Submit flags at: https://labs.professorsalazar.com/westbrook/ctf/
| Tool | Notes |
|---|---|
| Kali Linux | Or any Linux distro with GoBuster installed |
| GoBuster | Pre-installed on Kali at /usr/bin/gobuster |
| Web Browser | Firefox or Chromium |
| Wordlist | /usr/share/wordlists/dirb/common.txt (pre-installed on Kali) |
GoBuster is a directory and file enumeration tool used in penetration testing. It works by taking a wordlist and brute-forcing URLs against a target web server, reporting back which paths actually exist based on the HTTP response codes returned.
Understanding HTTP response codes is critical to interpreting GoBuster's output:
| Code | Meaning | What it tells you |
|---|---|---|
| 200 | OK | Page exists and loaded successfully |
| 301 | Redirect | Page exists but moved elsewhere — follow the redirect |
| 403 | Forbidden | Directory EXISTS but access is blocked — still useful! |
| 404 | Not Found | Path does not exist on the server |
robots.txt is a file that web servers use to tell search engine crawlers which pages they should not index. It is publicly readable by anyone.
From a security perspective it often inadvertently reveals the names of sensitive or hidden directories — making it one of the first files a penetration tester checks.
Everything rendered by your browser is delivered as HTML. Developers often leave comments, credentials, debug notes, and other sensitive data in the HTML that is invisible on the rendered page but fully visible in the source.
HTML comments use this syntax and will never display on screen:
FLAG, <!--, TODO, or password.Before running any tools, always start with manual checks. Navigate directly to:
Read the file carefully. Note every path listed under Disallow: — these paths exist on the server. Record your findings below:
| # | Disallowed Path | Notes |
|---|---|---|
| 1 | ||
| 2 | ||
| 3 | ||
| 4 | ||
| 5 | ||
| 6 |
Navigate to the main site:
Right-click anywhere and select View Page Source or press Ctrl+U. Use Ctrl+F to search for:
FLAG
<!--
TODO
password
admin
secret
<head> section, after the <nav>, inside the footer, and at the very bottom of the page.Open a terminal in Kali Linux and run the basic scan command:
For a more thorough scan (takes longer but finds more paths):
--exclude-length <N> where N is the reported false-positive length.As GoBuster runs, record every path it discovers below:
| # | Path Discovered | Status Code | Notes |
|---|---|---|---|
| 1 | |||
| 2 | |||
| 3 | |||
| 4 | |||
| 5 | |||
| 6 | |||
| 7 | |||
| 8 |
For every page GoBuster discovers, navigate to it and work through this checklist. Click each item to mark it complete.
Make sure you investigate all of the following pages thoroughly:
Record each flag as you find it. Enter where you found it and the full flag string. Click the ○ button to mark it as submitted to the portal. Submit all flags at: https://labs.professorsalazar.com/westbrook/ctf/
Answer the following questions based on your findings. Your responses will be discussed as a class after the lab. Use the OWASP Top 10 reference on the next section.
robots.txt reveal? Why is this a security concern?/admin page? What OWASP Top 10 category does this fall under?/dev page contains a ticket system that documents its own vulnerabilities. What does this tell you about the development team's security practices?/backup directory has an open listing showing files like .env.bak and database dumps. Why is this dangerous and how would you remediate it?/staff page to launch a social engineering or phishing attack?FLAG. Check the <head> tag, just below the <nav>, inside the footer, and at the very bottom of the page./usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt. If you see a wildcard error, use --exclude-length with the reported false-positive length.index.html file inside it. For example, try: /westbrook/admin/index.html<head>, inside the displayed code blocks on the page, inside ticket card comments, and at the very bottom of the <body>.Use this when answering the analysis questions in Part 5.
| ID | Category |
|---|---|
| A01 | Broken Access Control |
| A02 | Cryptographic Failures |
| A03 | Injection |
| A04 | Insecure Design |
| A05 | Security Misconfiguration |
| A06 | Vulnerable and Outdated Components |
| A07 | Identification and Authentication Failures |
| A08 | Software and Data Integrity Failures |
| A09 | Security Logging and Monitoring Failures |
| A10 | Server-Side Request Forgery (SSRF) |
Now submit your flags at the portal below.