Return to Archive
Mission Briefing
PortSwigger: Information Disclosure on Debug Page
November 2025
#PortSwigger#Web Security#Information Disclosure#Burp Suite
SME Classified
Find a leftover phpinfo debug page with Burp Suite's content discovery and read the SECRET_KEY environment variable.
Live Tactical Feed
Lab Walkthrough
01
Steps to solve
1. Right-click the home page (/) → Engagement tools → Discover content, then click "Session is not running" to start the scan. 2. Go to Target → Site map. 3. Select the lab URL → cgi-bin → phpinfo.php. 4. Right-click the request to phpinfo.php and copy its URL. 5. Open a new tab and paste it. 6. Press Ctrl+F and search for SECRET_KEY. 7. Copy the value of the SECRET_KEY variable and submit it as the solution.