Нулевой заказ (Null Order)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Arbitrary File Read via extension parameter manipulation, Client-side JavaScript analysis for hidden parameters

Summary

Task: Order Manager web app with hidden API parameters in JavaScript. Solution: Analyzed JS code to find ext parameter, changed file extension from .order to .txt to read flag file via Arbitrary File Read.

Нулевой заказ (Null Order) — hackerlab.pro

Description

У такой крупной компании заметно низкая активность заказов. Может они показывают на странице не всю информацию?

Analysis

Step 1: Exploring the Main Page

Opening the main page — we see an Order Manager with a table of orders.

Step 2: JavaScript Analysis

In the file /static/js/main.js we find the refreshOrders() function:

 javascript read-only • copy allowed Copy
function refreshOrders() {
    fetch('/index.php', {
        method: 'POST',
        headers: {
            'Content-Type': 'application/x-www-form-urlencoded'
        },
        body: 'ext=.order'
    })
    .then(response => response.text())
    .then(data => {
        // update orders table
    });
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The function makes a POST request with the parameter ext=.order — the server reads files with the specified extension.

Step 3: Exploitation

Changing the extension to .txt — the server returns the contents of the file with the flag!

Vulnerability

Arbitrary File Read (LFI) — the server reads files with the user-specified extension without any validation. By changing .order to .txt, we get the contents of the file with the flag.

Solution

 bash read-only • copy allowed Copy
curl -s -X POST http://62.173.140.174:16028/index.php -d "ext=.txt"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍