> For the complete documentation index, see [llms.txt](https://zanganox.gitbook.io/vulnerabilidades/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zanganox.gitbook.io/vulnerabilidades/symfony.md).

# Symfony

1:- Symfony Open Profiler Description Symfony Profiler is enabled and accessible. It leads to disclosure of sensitive information about the web application Open Profiler endpoint app\_dev.php/\_profiler/empty/search/results?limit=100

2:-Symfony Web Debug Toolbar Description When Symfony is used in development environment, the web debug toolbar is available at the bottom of all pages. It displays a good summary of the profiling data that gives you instant access to a lot of useful information when something does not work as expected. The web debug toolbar contains sensitive information and should not be present in production systems.

Symfony Web Debug Toolbar Access And Endpoint app\_dev.php/\_fragment

Bugs you can get

visit all tokens endpoint in app\_dev.php/\_profiler/empty/search/results?limit=100

<figure><img src="/files/2keiQ30eP9bGOMZ1K1On" alt=""><figcaption></figcaption></figure>

![](/files/gCzuFInimVVGNWD1AlkX)

by checking all log from tokens links you have a realtime logs and you can find some leaked cookies/user/password

You can also got a LFI on app\_dev.php/\_profiler/open?file=LFI As example app\_dev.php/\_profiler/open?file=app/config/parameters.yml

You can also try to find weak app secret and get RCE for more info and scan app secret <https://github.com/ambionics/symfony-exploits/blob/main/secret_fragment_exploit.py>

You can also try SQL injection in url it’s self app\_dev.php/1\[SQL] Sqlmap command sqlmap -u " target\[.]com/app\_dev.php/1\* " --dbms=mysql --threads=8 --leve 5 --risk 3 --random-agent --hostname --current-user --test-filter="MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID\_SUBSET)" --flush-session --dbs