YanoSecAn application's settings can expose information even when its main feature works. Configuration means the settings controlling how it runs. Debug mode enables extra diagnostic behavior. A default credential is an account or secret shipped with software and must not remain an unintended way into a deployed service.
The fictional app has two diagnostic switches enabled, so a public page reveals internal settings. Read the proposed changes by the behavior they alter. Changing a decorative setting does not change who can receive diagnostic information.
Before you begin
- Recommended first
- Notes: scope, command, result, time, HTTP methods, headers, status codes, cookies, How a web app is put together, Same-origin policy, File upload
- Estimated time
- 16 min reading, 12 min activity. Setup and optional practice may take longer.
- Where you work
- Read the original fictional requests, source fragments and state tables in a current desktop or mobile browser. The required activity needs no server, database, account or installed security tool. Do not send the printed requests to any service.
- Without a lab
- Use the complete printed evidence to trace the data or state on paper. Write the decision, the fact supporting it and one limit of the model, then compare with the activity rubric. This does not establish live service behavior. Reading works without JavaScript. Checking requires JavaScript and a secure browser context; saving also requires usable browser storage.
After this lesson you can:
- List what the public debug page prints.
- Separate the wallpaper edit from the settings that close the page.
- Leave the fictional account untried.
01Example
Read these fictional settings as input to a behavior decision. They describe a model rather than a running application.
debug = true
public_debug_page = true
wallpaper = blue
Model result: public diagnostics enabled.
Question to ask: which setting changes that exposure?02Match the change to the exposure
The public_debug_page setting controls the page in this model, and debug controls its diagnostic mode. Disable the public diagnostic behavior and remove unnecessary default accounts as separate changes. The exposure is supported by the printed settings and response description, rather than guessed from a version banner.
For a later authorized retest, check that an unauthenticated public request no longer receives those settings and that legitimate operation still works. No request is required here. The desk / desk-demo account is fictional and must not be tried on any service.
Read a public debug page as a configuration choice, and pick the change that closes it.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
public_debug_page = true
unmet · public_debug_page remains true.wallpaper = blue
excluded · Wallpaper changes appearance only.The wallpaper does not control this modeled exposure.
Choose the setting governing the evidenced exposure; a cosmetic setting cannot close it.
The wallpaper does not control this modeled exposure.
Follow the explanation
- The wallpaper does not control this modeled exposure.
- The direct setting-to-exposure relationship matters; this is not a configuration change or a real test.
Read every state and value
1. The wallpaper does not control this modeled exposure.
- Case
- wall
- Conditions inspected
- Exposure setting · Unrelated setting
- Decision shown
- Yes
2. The direct setting-to-exposure relationship matters; this is not a configuration change or a real test.
- Case
- exposure
- Conditions inspected
- Exposure setting · Unrelated setting
- Decision shown
- Yes
03Pick the change for the activity page
Read the evidence before comparing your reasoning with the activity rubric. Do not use the fictional account.
Owned app configuration. The account is fictional. Do not try it anywhere.
debug = true
public_debug_page = true
wallpaper = blue
account_name = desk
account_secret = desk-demo
The public debug page prints debug, public_debug_page, and wallpaper.
Proposed changes. One of them addresses the public debug page.
change wallpaper from blue to green
set debug = false
set public_debug_page = false
remove account_name and account_secret
Activity exposure: the public page prints session_store=memory because public_debug_page is true.
The change that removes that page is public_debug_page = false together with debug = false.
The wallpaper change leaves the page in place.
- Write the setting that causes the public page to print session_store.
- Mark the diff lines that set the diagnostic switches false, and mark the wallpaper line.
- Check: public_debug_page = false together with debug = false removes the page. The wallpaper change leaves it. The account lines are a separate removal.
- Stop. Do not try desk-demo anywhere.
04Optional challenge
Write a one-line check that the public diagnostic is gone, without including the fictional secret. The rubric is: the page no longer prints session_store, and the note does not contain the account lines. About ten minutes.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Configuration case A: new authored settingsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
debug=true
public_debug_page=true
Model response: an unauthenticated visitor receives implementation settings from the diagnostic page.
For this model, public_debug_page controls public availability and debug controls diagnostic mode.
Repair goal: disable public diagnostics and diagnostic mode; ordinary application pages must remain usable.
Configuration case B: independent verification cardsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
V1: public unauthenticated response no longer includes implementation settings; ordinary page still works.
V2: server logs stop including implementation settings; the public page still returns those settings.
V3: operator hides the diagnostic link; direct public response is unchanged.
These are hypothetical retest descriptions, not performed requests.
06Explain your evidence
Optional written self-check: explain one decision using the supplied case. No tool run is required.
Check your explanation: tie each setting to its modeled effect; change the diagnostic controls for the stated goal; verify the unauthenticated response and ordinary operation separately; avoid credential or product claims absent from the evidence.
07Common mistakes
If you pick the wallpaper line, the diagnostic page remains. Color is not the exposure.
If you try the account, you left the lesson. The secret is a placeholder.
If you treat a version banner as this finding, the finding on the card is the public page.
References
- PortSwigger: Information disclosure, including debug exposure
Explains the failure mechanism and prevention. Use it for further reading after reasoning from this page's original model; a topic page is not evidence that a lab was launched.