NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
Cobalt shipped a placeholder site — and accidentally deployed a developer file with it. Files that belong in a code repo are often left readable in the web root. Find the leftover README and read it; the flag is in the deployment notes.
It occurs when an application reveals data it should keep private, such as internal paths, credentials, comments or documentation. Attackers use these leaks to plan stronger attacks.
Why are README files risky on production servers?
They can reveal software names, versions, setup steps or credentials. Remove development files from deployed sites and restrict what the web server serves.
Do I need tools to solve README Leak?
A browser is enough. The challenge is easy and free on Codelivly, and teaches you to check common public files while enumerating a web application.