Platform: WebVerse Labs Challenge: Redirect Run Category: Web Difficulty: Easy
Step 1 — Find the Shortlink
The Quikpay landing page has a live demo shortlink sitting right on it:
qp.link/r/qp-r4-7821ab
Step 2 — Follow It In Burp
Visit the shortlink with Burp intercepting. The browser sees a “thanks for your purchase” page and moves on. Burp catches the 302 response before the redirect fires — and the body isn’t empty.
Step 3 — Read the Debug Comment
Buried in the 302 response body:
<!-- Quikpay redirect debug (production safe? — TODO: strip before launch) —
request_token: qp-r4-7821ab
upstream_status: 200
upstream_latency_ms: 38
internal_ref: WEBVERSE{...}
reconciliation_window: 24h
cookie_strip_policy: strict
note: leave this in until QA signs off on the new tracing pipeline
-->
internal_ref is the flag. The TODO never got done.
Why It Works
3xx redirect responses have a body — browsers just don’t render it. The dev team left a debug comment in the intermediate response assuming nobody would ever read it. Burp reads everything.
The Fix
- Never embed sensitive data in redirect response bodies
- Strip all debug comments before shipping to production
- QA sign-off shouldn’t be gated on leaving secrets in HTTP responses
The browser skipped right past it. Burp didn’t.
0xAdham