2 of spades

Solved by: Taz34

Did a NIKTO scan on the target

nikto -h

and one of the lines in the result showed this :

+ /.env: .env file found. The .env file may contain credentials.

so i headed to this sub directory

inserted the file name in the URL

and we have the flag.