Deep Into My Heart

🌐 Love at First Breach 2026 - Deep Into my Heart

Category	Author
🌐 Web	TryHackMe

Challenge Prompt

My Dearest Hacker,

Cupid’s Vault was designed to protect secrets meant to stay hidden forever. Unfortunately, Cupid underestimated how determined attackers can be.

Intelligence indicates that Cupid may have unintentionally left vulnerabilities in the system. With the holiday deadline approaching, you’ve been tasked with uncovering what’s hidden inside the vault before it’s too late.

You can find the web application here: http://MACHINE_IP:5000

Problem Type

• Web

Solve

I started off with a quick nmap scan of this host and port using nmap -p 5000 -T4 -A <IP Address>.
The very fist thing I noticed was a robots.txt file with a disallowed entry:

If we look at the robots.txt file we see there is a /cupids_secret_vault:

When we visit that page we get the message that we discovered the secret vault but there is more to discover:

The robots.txt file had a disallow for /cupids_secret_vault/* meaning there is probably another subdirectory.
I like ffuf so I used ffuf -w /usr/share/wordlist/dirbuster/directory-list-2.3-small.txt:FUZZ -u http://<SITE IP HERE>:5000/cupids_secret_vault/FUZZ.
This found an administrator subdirectory:

On the http://<SITE IP HERE>:5000/cupids_secret_vault/administrator page we get a login in prompt:

At first I tried the obvious administrator for the username and back on the robots.txt file we had a comment of cupid_arrow_2026!!! which I used for the password.
This surprisingly didn’t work, but changing the username to admin and using the password from the robots.txt file did the trick: