FirstBlood-#502Enumerating files/directories and tools/binaries installed on FirstBlood server
This issue was discovered on FirstBlood v2

On 2021-10-25, newrouge Level 3 reported:

Hey, while uploading vaccine certificate i noticed that endpoint .

  • Here proof parameter is seems to check if file exist on server or not.
  • But it can be abused to enumerate which binaries ,files or tools are installed or which directories are present on server.


?proof.php=/etc/hostname => returns true ,file exist

?proof.php=/bin/bash => return true, binary exist

?proof.php=/var/www/html => return true , directory exist

?proof.php=/etc/apache2/httpd. conf => returns false, makes sense server is using NGINX so why would apache files be there.

?proof.php=/etc/nginx => return true, right.


Thank you


P4 Low

Endpoint: /api/checkproof.php

Parameter: ?proof=

Payload: /etc/hosts /bin/bash

FirstBlood ID: 42
Vulnerability Type: Information leak/disclosure

The endpoint /api/checkproof.php can be used to check if an arbitrary file path exists on the server. There is no real impact from this and it's not something we intentionally added as an issue so this won't count towards a unique finding.