{
  "id": 7098290,
  "title": "Hacking VaultGate: Three Paths to One Flag",
  "url": "https://urgent.news/2026/09/13/hacking-vaultgate-three-paths-to-one-flag",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-13T11:13:18.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/__94802c1f2b15/hacking-vaultgate-three-paths-to-one-flag-3mge"
  },
  "original_language": "en",
  "account": "VaultGate, an open-source CTF challenge, is hosted locally on a Docker container for easy testing and practice. The app is built using Node.js, Express, and SQLite, and features a chatbot called VaultBot. The flag, CTF{vaultgate_three_paths_one_flag}, is hidden on the server, and the objective is to recover it.\n\nThere are three independent ways to access the app, all leading to the flag. Path 1 involves guessing the admin password, opening the maintenance console, and pivoting through a hidden helper service to read the flag file. Path 2 exploits an outdated dependency to run commands without logging in. Path 3 involves interacting with the site's chatbot to leak the secret.\n\nThe reconnaissance phase involves gathering information about the target before attempting any attacks. This includes asking the server for its identity (curl -sSI), cross-checking the server information with another tool (whatweb), reading the robots.txt file (curl -s), and examining the /api/status endpoint (curl -s) to discover the app's exact version and dependencies.",
  "summary": "Target: http://192.168.122.1:3000 — a local Docker deployment of VaultGate on my lab network (your target IP will differ). Download VaultGate: it's open-source — grab it and spin up your own copy in one command (see Section 8): https://github.com/todorslavovv/three-paths-ctf Rig: a Kali Linux VM attacking the target across a private network. The app runs in a disposable Docker container. The flag…",
  "key_points": [
    "Three independent paths lead to the flag CTF{vaultgatethreepathsoneflag}",
    "Path 1: Guess admin password, access maintenance console, pivot through helper service",
    "Path 2: Exploit outdated dependency to run commands without logging in"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}