DEV DIARIES — COMPLETE WALKTHROUGH — TryHackMe

TASK 1: CHALLENGE

We have just launched a website developed by a freelance developer. The source code was not shared with us, and the developer has since disappeared without handing it over.

Despite this, traces of the development process and earlier versions of the website may still exist online.

You are only given the website’s primary domain as a starting point: marvenly.com

Q1: What is the subdomain where the development version of the website is hosted?

visit crt.sh

Searched for the target domain: marvenly.com

Answer: uat-testing.marvenly.com

Q2: What is the GitHub username of the developer?

visit uat-testing.marvenly.com

Checked the footer and found a username. Verified it by searching on Google and confirming the profile on GitHub.

Answer: notvibecoder23

Get ANWAR1’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Q3: What is the developer’s email address?

• Used git clone to download the repository
• Ran git log to view commit details
• Found the email in the author information

Answer: freelancedevbycoder23@gmail.com

Q4: What reason did the developer mention in the commit history for removing the source code?

Checked commit history using git log and found the reason.

Answer: The project was marked as abandoned due to a payment dispute

Q5: What is the value of the hidden flag?

• Checked the commit history on GitHub.
• Viewed the third commit
• Found the hidden flag in the changes.

Answer: THM{g1t_h1st0ry_n3v3r_f0rg3ts}

Tools Used:

• crt.sh
• GitHub
• Google
• Git

Conclusion:
This lab demonstrated how useful publicly available information can be in reconnaissance. By analyzing subdomains, GitHub repositories, and commit history, sensitive details like emails and hidden data can be discovered.