Secret Administrative Pages

  Back Help Me!

Hints and Videos

Platform Path Disclosure

Application Path Disclosure

Information Disclosure

Secret Administrative Pages

Using Burp-Suite

Using OWASP Zed Attack Proxy (ZAP)

"Secret" administrative or configuration pages

Showing server configurations on pages allowed through the firewall is a bad idea. "Hiding" pages by not linking to them so you believe you are the only one who knows the URL doesnt work. There are tools to brute force the URL, shoulder surfing, log history, browser history, router-firewall-proxy history, scanners, guessing and other methods can get these URLs. or admin functions, create a second site inside the firewall to segregate these pages from the Internet facing site.

I wonder what clever name the server admin would give to a PHP page that shows server configuration information? Hint: What is the function in PHP that dumps server configuration information into a nice table? Enable hints if you need more help.