I have found the directory whose contents can be listed and have manually checked all folders underneath for the flag.txt file but cannot find it. Looking for hint or even better, advice on how to solve with a better technique
Are you in the Skill Assessment?
No, just the first exercise in the module
Oh ok, without spoilers, try to found out the flag in the each folders inside of the wp-content folder. If you have a problems you try to read again the structure of WordPress section.
2 Likes
wp-content does not list anything, neither does the subdirectories plugins or themes. 
uploads returns content, but there is no flag.txt in there. I have been looking under wp-includes because it actually lists content.
Regardless, thanks for your help/response
Just figured it out. If anyone needs a nudge, feel free to message me on here
1 Like
Can anyone please give me a hint ? I did everything else but I am stuck on this question.
Hey there, I need a nudge lol. I’ve been stuck on the same problem for ages. I’ve gone through every folder in wp-includes, as well as wp-content and uploads. Any further hints? Thanks
congrats on your first post to the forums!
my hint is this: Directory indexing is disabled on a per-folder basis. Sometimes child directories will have directory indexing enabled even when their parents have it disabled. You are right about it not being in uploads, but what other directories have you learned about in the module so far? Your answer will be in a module section other than WordPress Structure. Don’t waste time going through wp-includes
2 Likes
I was overthinking this as well. Was ALL over the place in directories.
Take a step back read the instruction and examples and don’t divert too much from the example - it is the first task they would not make it complicated.
I missed it with curl but was “showing source code” in firefox and stepped trough the folders using browser it made it easier for me (again look at the example given that is the hint).
It took me a while aswell, the hint does not help too much…
It is better to ignore hints and usepowerful tools like wpscan. This way you can analyze the site and then check for directories manually with some recognaissance…
The start of the question is the most usful hint…
Keep in mind the key WordPress directories discussed in the WordPress Structure section. Manually enumerate the target for any directories whose contents can be listed. Browse these directories and locate a flag with the file name flag.txt and submit its contents as the answer.
Although I tried wfuzz and gobuster to look for txt files; I solved this by using html2txt and grep , and being manually curious about the directories I was presented wtih.
Without giving it all away, i hope this helps. DM me if you get desperate 
heya! I’m still struggling to find the right directory. Checked all wp-includes, wp-content, /uploads, /plugins… mostly all. Even checked the source code couldn’t find any hint… any real hint please??
That’s correct they not listing anything
Good hint, thanks!