Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Advanced Automation - Directory Monitor
Mission
`/challenge/logs/` holds a large set of access logs. Aggregate status-404 requests per source IP and identify the single scanner IP with an overwhelming 404 count. The flag is on that IP's line that carries a `note=` field. Several decoy IPs have moderate 404 counts, so aggregation -- not a naive threshold -- is required.
Hints
Hint 1 Show
Aggregate the large access logs under logs/; count status-404 requests per source IP
Hint 2 Show
Exactly one IP (the scanner) has an overwhelming 404 count; identify it by aggregation
Hint 3 Show
The flag is on that IP's line that carries a note= field