HackerDNA Secrets in Source Lab Writeup

Lab Writeup: Secrets in Source

Lab Reference: This is a walkthrough for the Secrets in Source challenge on HackerDNA.

1. Objective

The goal of this lab is to find hidden security vulnerabilities or hardcoded sensitive information left behind in the source code of the web application.

2. Information Gathering & Reconnaissance

• Inspecting the Page: I opened the target challenge page and right-clicked to select View Page Source (or pressed Ctrl + U).
• Analyzing Scripts: I searched through the HTML structure and looked closely at the linked JavaScript files to see how the client-side application handles data.

3. Exploitation & Discovery

• While reviewing the JavaScript code and HTML comments, I discovered hardcoded credentials/comments left behind by the developer.
• I used these exposed credentials to find the required access tokens to complete the objective.

4. Conclusion & Remediation

Developers should never store sensitive variables, passwords, or API keys directly in client-side code. To fix this vulnerability, these configurations should be handled securely on the backend using environment variables.