Room 404
He booked the quiet room. It's not on the floor plan, not in the brochure, not on any door. But port 8080 is wide open, and the rooms it never lists are the ones worth finding.
Solution
Directory Enumeration
Started with dirb against the web root to look for hidden files/directories.
.git/HEAD returns 200 OK — the application’s .git directory is exposed on the live web server. This is a classic misconfiguration: a git repo deployed alongside the app without excluding the .git folder.
Confirm Exposure
Browsed directly to the .git path to confirm directory listing is enabled.
A full directory listing of the .git internals is available; that’s enough to reconstruct the entire repository, including its commit history.
Dump the Repository
Used git-dumper to pull down the full repo from the exposed .git directory.
git-dumper recursively fetches every object, ref, and log needed to rebuild the working tree locally in the repo/ folder.
Recover the Source & Find the Flag
With the repo reconstructed locally, listed the files and read the README.
And we found the flag!
DONE!!!