PortSwigger Lab Solution: Information Disclosure on Debug Page Walkthrough (Apprentice)

Learn how to identify exposed debug pages, discover hidden HTML comments, and extract sensitive information using Burp Suite in the PortSwigger Web Security Academy.

Debug pages are valuable during development because they help developers troubleshoot applications. However, if these pages remain accessible in production, they can expose sensitive information such as environment variables, secret keys, server configuration, framework versions, and other internal implementation details. Attackers frequently search for these pages during reconnaissance because they often provide valuable intelligence for further exploitation.

In this walkthrough, we'll solve the Information Disclosure on Debug Page lab from the PortSwigger Web Security Academy using Burp Suite. You'll learn how to identify hidden debug references, access exposed development endpoints, extract sensitive information, understand the security risks, and apply best practices to prevent information disclosure vulnerabilities.

📌 Lab Information

Difficulty: Apprentice

Category: Information Disclosure

Objective: Find an exposed debug page that reveals a secret key and submit it to solve the lab.

Lab URL: https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-on-debug-page

🎯 What You'll Learn

By completing this lab, you'll learn how to:

✅ Discover hidden debug references inside HTML source code.

✅ Identify exposed development endpoints using Burp Suite.

✅ Extract sensitive information from a publicly accessible phpinfo() page.

✅ Understand why debug pages create serious information disclosure risks.

✅ Implement security best practices to protect production environments.

🔍 Understanding the Vulnerability

Information disclosure occurs when an application unintentionally exposes internal implementation details that should never be available to end users.

One of the most common causes is leaving development or debugging functionality enabled after deployment.

Examples of exposed debug resources include:

• phpinfo.php

• /debug

• /status

• /actuator

These endpoints may reveal:

• Environment variables

• Secret keys

• PHP and framework versions

• Installed modules

• Server configuration

• Internal file paths

Although intended for debugging, this information significantly helps attackers fingerprint an application and identify potential attack vectors.

🎯 Identifying the Attack Surface

Browse the application and open any product page.

Inspect the response using Burp Suite Repeater or view the page source.

Inside the HTML response, you'll notice the following comment:

<!-- <a href="/cgi-bin/phpinfo.php">Debug</a> -->

<!-- <a href="/cgi-bin/phpinfo.php">Debug</a> -->

Although HTML comments are hidden from normal page rendering, they remain visible in the source code. Developers sometimes leave debugging references inside comments without realizing that anyone can view them.

The comment reveals the existence of the following endpoint:

/cgi-bin/phpinfo.php

/cgi-bin/phpinfo.php

⚙️ How the Vulnerability Occurs

The vulnerability occurs because development artifacts were left accessible in the production environment.

HTML Comment
        │
        ▼
Attacker Views Source Code
        │
        ▼
Hidden Debug Endpoint Discovered
        │
        ▼
Debug Page Accessed
        │
        ▼
Sensitive Information Exposed

HTML Comment
        │
        ▼
Attacker Views Source Code
        │
        ▼
Hidden Debug Endpoint Discovered
        │
        ▼
Debug Page Accessed
        │
        ▼
Sensitive Information Exposed

This happens because:

• Debug endpoints were not removed before deployment.

• HTML comments expose internal application resources.

• The debug page is publicly accessible without authentication.

• phpinfo() reveals sensitive environment information.

🚀 Exploitation Steps

Step 1: Browse the Application

Open the lab and browse the target application.

Click on any product page.

Step 2: Inspect the Response

Locate the request in Proxy → HTTP History.

Right-click the request and select Send to Repeater.

Click Send and inspect the HTML response.

Step 3: Locate the Hidden Debug Reference

Search the response body for HTML comments.

You'll discover:

<!-- <a href="/cgi-bin/phpinfo.php">Debug</a> -->

<!-- <a href="/cgi-bin/phpinfo.php">Debug</a> -->

This confirms that a debug page exists.

Step 4: Access the Debug Page

Request the following resource:

GET /cgi-bin/phpinfo.php HTTP/1.1
Host: <lab-id>.web-security-academy.net

GET /cgi-bin/phpinfo.php HTTP/1.1
Host: <lab-id>.web-security-academy.net

Click Send.

Step 5: Retrieve the Secret Key

The response displays the output of phpinfo().

Search for:

SECRET_KEY

SECRET_KEY

The corresponding value is the answer required to complete the lab.

Note:_ Every PortSwigger lab instance generates a unique secret key, so your value will be different._

⚠️ Security Impact

If exposed in a real-world application, debug pages can allow attackers to:

• Retrieve secret keys and environment variables.

• Identify PHP versions and installed modules.

• Discover server configuration details.

• Reveal internal file paths.

• Collect valuable reconnaissance information for future attacks.

🛡️ Remediation

Developers should follow these security best practices:

✅ Remove all debug pages before deploying to production.

✅ Never expose phpinfo() on publicly accessible servers.

✅ Remove HTML comments containing sensitive information.

✅ Store secrets securely using environment variables and never expose them through debugging tools.

✅ Restrict access to administrative and development endpoints.

📖 Key Takeaways

Debug pages and development artifacts should never remain accessible in production environments.

✔ HTML comments can unintentionally expose hidden functionality.

✔ Publicly accessible debug pages may leak sensitive application information.

✔ Attackers actively search for forgotten development resources during reconnaissance.

✔ Secure deployment practices help prevent information disclosure vulnerabilities.

📚 References

PortSwigger Web Security Academy

https://portswigger.net/web-security/information-disclosure

OWASP Top 10

https://owasp.org/www-project-top-ten/

🤝 Connect with Me

If you enjoy practical cybersecurity content and hands-on PortSwigger Web Security Academy walkthroughs, feel free to connect with me.

🌐 Portfolio https://rahulms.qzz.io/

💻 GitHub https://github.com/1amrahul

💼 LinkedIn https://linkedin.com/in/rahul-m-s-372b631a2

If this walkthrough helped you, consider following this publication for more PortSwigger Web Security Academy lab solutions, Burp Suite tutorials, web application penetration testing (VAPT) guides, and practical web application security content.

Contents