During App Service enumeration, you discover that the compromised user can read App Service application settings. Find the hidden flag stored in the application settings.
Correct Answer:
See the Answer in Explanation below. Explanation: Flag{app_settings_should_not_store_secrets} Detailed Solution: Query App Service settings: az webapp config appsettings list \ --name finance-reporting-api \ --resource-group rg-prod-apps-eastus \ --output json Search for suspicious keys: az webapp config appsettings list \ --name finance-reporting-api \ --resource-group rg-prod-apps-eastus \ --query " [?contains(name, ' FLAG ' ) || contains(name, ' Flag ' ) || contains(name, ' SECRET ' )] " \ --output table Expected output: Name SlotSetting Value ---------- ------------- ---------------------------------------- APP_FLAG False Flag{app_settings_should_not_store_secrets} The flag is: Flag{app_settings_should_not_store_secrets}
