Провальный код (Failed Code)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-04 | Status: Solved Techniques: Authentication redirect bypass, Direct page access bypass, Unprotected endpoint discovery, Web enumeration

Summary

Task: Web application with login page and redirect protection. Solution: Direct access to admin.php bypasses authentication - the redirect was only implemented on index.php, leaving admin panel unprotected.

Провальный код (Failed Code) — HackerLab

Description

Мы совсем не доверяем кодеру этого веб-приложения. Как думаешь, зря?

Translation: We don't trust the coder of this web application at all. Do you think it's for nothing?

Analysis

Reconnaissance

Main page (index.php):

• HTTP 302 redirect to login.php
• Developer tried to protect the main page with a redirect

Login page (login.php):

• Simple form with username/password
• Standard attacks don't work:
  • Default credentials (admin:admin, admin:password) — no
  • SQL injection — no
  • Type juggling — no ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Checking backup files:

• .bak, .swp, ~ — not found
• login.phps, index.phps — 403 Forbidden (interesting, but not exploitable)

Standard paths:

• robots.txt — 404
• .git — 404
• register.php — 404

Key Observation

The task description hints at developer incompetence. If the redirect is implemented incorrectly, there might be unprotected pages.

Solution Idea

Try direct access to typical administrative pages:

• admin.php
• dashboard.php
• panel.php
• flag.php

Solution

Direct Access to admin.php

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl http://62.173.140.174:16058/admin.php

Response:

 html read-only • copy allowed Copy
<!DOCTYPE html>
<html>
<head>
    <title>Admin Panel</title>
</head>
<body>
    <h1>Welcome to Admin Panel!</h1>
    <p>Flag: CODEBY{REDACTED}</p>
</body>
</html>

Flag obtained without any authentication!

Vulnerability

Incorrect Authentication Implementation

The developer made a classic mistake:

 php read-only • copy allowed Copy
// index.php (WRONG)
<?php
if (!isset($_SESSION['user'])) {
    header('Location: login.php');
    // Forgot exit; after redirect!
}
?>
<!-- Or redirect exists, but only on index.php -->
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

// admin.php (VULNERABLE)
<?php
// No authentication check at all!
?>
<h1>Admin Panel</h1>
<p>Flag: <?php echo $flag; ?></p>

Correct Implementation:

 php read-only • copy allowed Copy
// Every protected page must check authentication
<?php
session_start();
if (!isset($_SESSION['user']) || $_SESSION['role'] !== 'admin') {
    header('Location: login.php');
    exit; // IMPORTANT: exit after redirect!
}
?>

Technique: Unprotected Endpoint Discovery

Typical Unprotected Pages:

/admin.php
/admin/
/dashboard.php
/panel.php
/flag.php
/secret.php
/config.php
/backup.php
/test.php
/debug.php

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Automation:

 bash read-only • copy allowed Copy
# Quick check of typical admin pages
for page in admin dashboard panel flag secret config backup test debug; do
  code=$(curl -s -o /dev/null -w "%{http_code}" "http://target/$page.php")
  echo "$page.php: $code"
done

# Or with ffuf
ffuf -u http://target/FUZZ.php -w /usr/share/seclists/Discovery/Web-Content/common.txt

Lessons

1. Check all pages — not just those linked from the site
2. Redirect != protection — redirect on one page doesn't protect others
3. Read the description — hints about "bad developer" often indicate simple mistakes
4. Security through obscurity doesn't work — hidden pages will still be found ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Related Vulnerabilities

• Broken Access Control (OWASP Top 10)
• Missing Function Level Access Control
• Insecure Direct Object Reference (IDOR)
• Authentication Bypass ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍