EH-25: Sensitive Data Exposure - Data Bocor di Response

Tools: curl, jq

cd ~ && mkdir -p eth-l25 && cd eth-l25
cat > server.py << 'PYEOF'
from flask import Flask, jsonify
app = Flask(__name__)
@app.route('/api/users')
def users():
    return jsonify([{"id":1,"username":"admin","password":"flag{Data_Exposure}","email":"[email protected]","credit_card":"4111-2222-3333-4444","cvv":123}])
@app.route('/')
def home():
    return "<!-- DB_PASS=SuperSecret2024 --><!-- API_KEY=sk-abc... -->"
app.run(port=9023)
PYEOF
python3 server.py &
sleep 1

echo "=== 1. Password in API Response ==*"
curl -s http://localhost:9023/api/users | jq .
echo ""
echo "=== 2. Comments in HTML ==*"
curl -s http://localhost:9023/ | grep -o "<!--.*-->"

kill %1 2>/dev/null

Refleksi: Sensitive data exposure terjadi ketika developer tidak sengaja mengirim terlalu banyak data di response. Prinsip: hanya kirim data yang diperlukan.

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy