Break It, Then Ask Why: Exposing a Hidden Internal Dev Console With One Flipped Flag
Honestly, this one was kind of an accident. I'd been on this travel site for a couple of hours (the big booking one) and had basically nothing to show for it. Ran through the usual stuff on the endpoints I could find and none of it went anywhere. When I get to that point I tend to stop looking for a specific bug and just start breaking things to see how the app reacts, and that's how I ended up…
This report details how a hidden internal developer console was exposed on a travel booking website. The author, who was browsing the site for a few hours, stumbled upon the issue after enabling all boolean flags to true. The console appeared due to validation flags being set to false in production. The console contained tabs with internal service names, ports, and override options, revealing the backend architecture.
The bug was classified as P4 and resolved with a small payout. The incident highlights the importance of not shipping debug tools to production and enforcing them on the server side, as the console provided invaluable information for reconnaissance.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
