Secure Legion Labs
Labs / Misconfig / Debug Mode

Misconfiguration Lab

Debug Mode Exposure

This room simulates a production application where internal troubleshooting endpoints were left exposed after deployment. Your goal is to reach the debug route, trigger verbose output, and identify the leaked secret material.

ObjectiveTrigger exposed debug outputReach the internal diagnostic endpoint and pull a verbose trace in production.
FocusOperational leakageLearn how debug mode reveals stack traces, environment values, and sensitive internals.
FlagUnlock after full leakThe flag appears only when the intended debug trace is exposed.
Assessment Notes

What an assessor already knows

Deployment Story

The engineering team used a lightweight debug switch during staging and claimed it was turned off before launch.

Observed Clue

A JavaScript bundle still references internal routes starting with /__debug/.

Likely Risk

If diagnostics are still reachable in production, the response may expose framework traces, environment values, and internal implementation details.

Testing Direction

What to try

  • Probeinternal debug-style routes
  • Probeverbose or diagnostics switches
  • Goalexpose a sensitive production trace
Request Console

Probe the debug route

Adjust the endpoint and the verbose switch. The intended production leak only appears when the right route and debug mode are both active.

Current request: GET /?verbose=
{ "status": "idle" }
Application trace preview
Rendered Output

Response trace

Once verbose debug mode is reachable in production, a normal request turns into an internal leak of implementation details and secrets.

No request sent yet.
Trace: unavailable.

Status: waiting for a request.

Flag Unlock

Challenge flag

The flag appears after you expose the intended debug leak.

Flag:
Submit Flag

Validate completion

Submit the unlocked flag to complete the room.

Flag is locked until you trigger the exposed debug trace.

Leak Path

How the weakness works here

1. Guess internal route

The tester finds a likely debug endpoint through source clues or predictable naming.

2. Enable verbose mode

A debug switch that should be disabled in production still returns detailed traces.

3. Leak secrets

The application exposes stack details and signing data that should never leave the server.