Comments in the source with a key in them
10 points · about 20 minutes · flag formatDC{...}Brief
Information disclosure is the application handing out something it should have kept — a stack trace naming internal paths, a comment holding a key, a debug endpoint, a backup file left in the web root, a verbose error that confirms what an attacker guessed.
This lab: Comments in the source with a key in them. Find the secret the application leaks without meaning to.
Work it against your own copy of the target. When you have the flag, submit it below.
Objective
Find where the application says more than it should, and read the secret it leaks. Capture the flag hidden in what it exposes.
Sign in and join the Academy to submit a flag, take hints and track your progress.
Sign inWalkthrough
Locked until you solve it — or reveal it above, which forfeits the points. 3 hints available before then.