diff options
| -rw-r--r-- | Information leakage/Resources/notes.md | 12 | ||||
| -rw-r--r-- | Information leakage/flag | 1 |
2 files changed, 13 insertions, 0 deletions
diff --git a/Information leakage/Resources/notes.md b/Information leakage/Resources/notes.md new file mode 100644 index 0000000..9f13add --- /dev/null +++ b/Information leakage/Resources/notes.md @@ -0,0 +1,12 @@ +## Exploit + +1. Found a comment saying `You must come from : "https://www.nsa.gov/` +1. Since one cannot edit the **Referer** header in Firefox, I used `curl --header "Referer: https://www.nsa.gov" "http://10.0.2.15/?page=b7e44c7a40c5f80139f0a50f3650fb2bd8d00b0d24667c4c2ca32c88e13b758f"` +1. Found another comment in the returned page: `Let's use this browser : "ft_bornToSec". It will help you a lot.` +1. Added a `User-Agent` header `ft_bornToSec` and found the flag. Complete command: `curl --header "User-Agent: ft_bornToSec" --header "Referer: https://www.nsa.gov/" "http://10.0.2.15/index.php?page=b7e44c7a40c5f80139f0a50f3650fb2bd8d00b0d24667c4c2ca32c88e13b758f" | grep "The flag"` + +## Fix + +[https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/05-Review_Web_Page_Content_for_Information_Leakage]() + +Don't put sensitive information in HTML code. diff --git a/Information leakage/flag b/Information leakage/flag new file mode 100644 index 0000000..4916501 --- /dev/null +++ b/Information leakage/flag @@ -0,0 +1 @@ +f2a29020ef3132e01dd61df97fd33ec8d7fcd1388cc9601e7db691d17d4d6188 |