Information Disclosure - Applied Review

Information disclosures seem to be highly contextual depending on where you find them and what kinds of protections are in place. Either way, we will go over some common areas to look for information disclosure and how you could exploit it.

What is Information Disclosure?

#

Also called information leakage, is when a website unintentionally reveals sensitive information to its users.

As you might expect, different information holds differing levels of severity based on what that leaked information actually is.

This could be user data, business secrets, or technical details about the web application and the infrastructure it is hosted on.

Some examples are:

• Hidden directories in the page source, or the robots.txt file.
• Providing access to source code backups
• Explicitly mentioning database tables
• Unnecessarily exposing PII or PHI
• Hard-coding API keys, IP addresses, or database credentials into the page source
• Hinting at the existence or absence of resources, usernames, and so on via differences in application behavior

How Does This Happen?

#

It can happen in a large number of different ways but here are some of the broader categories of how it might happen:

• Developers fail to remove internal content/references from public-facing content
• Insecure configuration of the website and related technologies, like forgetting to disable debugging or draft pages from a site pushed to production.
• Flawed design and behavior that might allow an attacker to enumerate different sensitive data.

What is the impact of information disclosure vulnerabilities?

#

Like a lot of the questions here, it depends on what data was leaked and how much. Leaking usernames is going to have a far different impact than leaking user credit cards.

Sites can also leak technical information that could point an attacker to a more vulnerable part of the system, like exposing a version number of a plugin.

Exploiting Information Disclosure

#

Sensitive data can be leaked in all sorts of different locations, so try not to miss anything that might end up being useful later down the line.

An important skill is having the intuition to recognize interesting or useful information when you see it.

You will generally find this information by either:

• Fuzzing
• Using the Burp Scanner
• Using Burp Suite Engagement Tools
• Generating Informative Responses

Common Sources for Information Disclosure

#

• Files for web crawlers
• Directory listings
• Page source comments
• Error messages
• Debugging data
• User Account Pages
• Backup Files
• Insecure Configuration
• Version Control History

I’ve chosen a few examples from Hack The Box to use for practice:

Quiz 1 - HTB Cache

#

This machine presents a web application that appears to be a blog with a login page. If you view the source code for the login.html page you’ll see a reference to a file called functionality.js.

This functionality.js file contains a plaintext username and password and it also outlines the entire login functionality for the site.

The login page redirects us to net.html which is also accessible without logging in.

Quiz 2 - HTB Vessel

#

This machine also shows us a web application where we can do some directory enumeration to reveal hidden content in the form of a git repository.

We can enumerate the directories with something like Ffuf or dirbuster, and dump the repository with git-dumper.

First we run git-dumper:

╰─ python3 -m git_dumper http://10.129.227.225/dev/.git git-repo
[-] Testing http://10.129.227.225/dev/.git/HEAD [200]
[-] Testing http://10.129.227.225/dev/.git/ [302]
[-] Fetching common files
[-] Fetching http://10.129.227.225/dev/.gitignore [302]
[-] http://10.129.227.225/dev/.gitignore responded with status code 302
[-] Fetching http://10.129.227.225/dev/.git/COMMIT_EDITMSG [200]
---SNIP---

Then, we can move into the repo and look for changes:

╰─ git log   

commit 208167e785aae5b052a4a2f9843d74e733fbd917 (HEAD -> master)
Author: Ethan <ethan@vessel.htb>
Date:   Mon Aug 22 10:11:34 2022 -0400

    Potential security fixes

commit edb18f3e0cd9ee39769ff3951eeb799dd1d8517e
Author: Ethan <ethan@vessel.htb>
Date:   Fri Aug 12 14:19:19 2022 -0400

    Security Fixes

commit f1369cfecb4a3125ec4060f1a725ce4aa6cbecd3
Author: Ethan <ethan@vessel.htb>
Date:   Wed Aug 10 15:16:56 2022 -0400

    Initial commit

Then we can look at differences between commits:

╰─ git diff edb18f3 208167e

diff --git a/routes/index.js b/routes/index.js
index 0cf479c..69c22be 100644
--- a/routes/index.js
+++ b/routes/index.js
@@ -1,6 +1,6 @@
 var express = require('express');
 var router = express.Router();
-var mysql = require('mysql');
+var mysql = require('mysql'); /* Upgraded deprecated mysqljs */
 var flash = require('connect-flash');
 var db = require('../config/db.js');
 var connection = mysql.createConnection(db.db)

And if we look at config/db.js we see this:

╰─ cat db.js   
var mysql = require('mysql');

var connection = {
        db: {
        host     : 'localhost',
        user     : 'default',
        password : 'daqvACHKvRn84VdVp',
        database : 'vessel'
}};

module.exports = connection;

Which leaks not only the source code for the web application, but also a password for the MySQL server running on the same infrastructure.

Prevention

#

Preventing information disclosure completely is tricky due to the huge variety of ways in which it can occur but implementing some best practices can make it easier to avoid:

• Make sure that developers are aware of which information is sensitive.
• Audit any code for potential information disclosures.
• Use generic error messages as much as possible so you don’t provide extra information.
• Double check that debugging features are disabled in a production environment.
• Make sure you understand the third party technology that you implement.