Lab Write-up: Information Disclosure on Debug Page

Objective

The objective of this lab is to locate a hidden debug page exposing sensitive environment details, extract the application's SECRET_KEY, and submit it to solve the lab.

Step-by-Step Exploitation

Step 1: Discover Hidden Pages via Site Map

1. With your browser traffic flowing through Burp Suite, open the lab home page.
2. In Burp Suite, go to the Target tab and look at the Site Map.
3. Expand the target host directory tree. You will notice a hidden path uncovered by structural scanning or page links: /cgi-bin/phpinfo.php.
4. Right-click the phpinfo.php file under the /cgi-bin directory and select Send to Repeater.

Step 2: Inspect the Debug Page and Extract Secret Key

1. Navigate to the Repeater tab where your request to /cgi-bin/phpinfo.php is staged.
2. Click Send to fetch the content of the debug page.
3. Use the search bar at the bottom of the Response pane to search for keywords like "SECRET" or "KEY".
4. The page will reveal a table containing system environment variables, exposing the value of the SECRET_KEY.

Step 3: Submit the Solution

1. Copy the secret key value revealed in the response (e.g., q57grw810nqe0pjzyzgj7eudn7bhjunq).
2. Head back to the lab application page in your browser.
3. Click on the Submit solution button at the top banner, paste the key into the input field, and press OK to complete the lab.

Remediation

Leaving diagnostic software or default test configurations accessible on public endpoints creates a significant risk profile. Fix this issue by applying these controls:

• Remove Debug Pages in Production: Ensure tools like phpinfo(), Django debug endpoints, or Rails development panels are entirely disabled or removed prior to deploying the system to live hosting environments.
• Restrict Access Controls: If internal debugging information must be kept on the server, tightly restrict access using IP whitelisting or robust server-level authentication mechanisms so it cannot be reached by public web users.