Information disclosure on debug page | Dec 16, 2022
Introduction
Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: Information disclosure in error messages! Without further ado, let’s dive in.
- Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆
Background
This lab contains a debug page that discloses sensitive information about the application. To solve the lab, obtain and submit the SECRET_KEY environment variable.
Exploitation
Home page:
Let’s view the source page!
</div>
</section>
<!-- <a href=/cgi-bin/phpinfo.php>Debug</a> -->
Oh look! We found an interesting HTML comment tag! Which is an <a> tag that pointing to PHP info page!
Let’s go there:
In the Environment session, we found a SECRET_KEY!
What we’ve learned:
- Information disclosure on debug page