Information disclosure
Lab:~# Information disclosure in error messages
In today’s Web Security Academy lab, we are focusing on information disclosure. This lab highlights how verbose error messages can expose the use of a vulnerable version of a third-party framework. To complete the lab, you need to identify and submit the version number of this framework.
What is information disclosure?
Information disclosure, also known as information leakage, is when a website unintentionally reveals sensitive information to its users.
End Goals:~#
- Identify the version number of the framework.
- submit the version of the framework.
Steps To Reproduce
- The web application in question is an SHOPING site. First, we should test all the features and functionalities of the app. Additionally, open your proxy to begin collecting requests.
- When viewing each product, the web application assigns a unique numeric ID to each item.
- Let’s try changing the numeric ID to a number that doesn’t exist to see if it causes any errors. This will help us understand how the web app handles invalid IDs.
- I changed the value of the ID parameter to 1111, but the response status code returned a 404 Not Found error.
- Changing the value of ID parameter to
'caused an error to be displayed. This error message, which the server should not disclose, revealed information about the framework version being used.
- This reveals that the lab is using Apache Struts 2 2.3.31.
- By submitting this information, we successfully completed the lab. That’s pretty cool!
That’s all, friends. Thank you for reading up to this point. I would like to hear your feedback on anything not clear here. Here is my Twitter account @T3chnocr4t. Feel free to DM me if you have any issues with my write-up. Thanks!