Symfony Profiler Console Symfony 3.4 ⚠ DEBUG: ON
PHP 7.4.33 host example.com
📡 Symfony Endpoints
🔬 Vulnerability Info

CVE: N/A (Debug mode misconfig)

Impact: Information disclosure — DB creds, API keys, secrets

Version: Symfony 3.4.x

Setting: app_dev.php accessible

📖 Symfony Profiler docs →

🔬 Symfony Profiler — Debug Mode Enabled

This is a simulation of a Symfony 3.4 application running in debug mode with the profiler exposed. The app_dev.php front controller is accessible, allowing anyone to interact with the Symfony profiler endpoints.

📋 Info
🔍
Profiler endpoints are accessible
200 OK + X-Debug-Token
🚨 Exploit
💀
Credentials and secrets exposed!
Full parameters.yml disclosure
🔓 How Symfony Profiler Debug Mode Exploitation Works

When a Symfony application is deployed with app_dev.php accessible (the development front controller), attackers can access the Symfony Profiler — a powerful debugging tool that exposes sensitive information.

Key endpoints to fuzz:
/app_dev.php — Front controller (debug mode)
/_profiler/phpinfo — PHP configuration with env vars
/_profiler/ — Request history dashboard
/_profiler/open?file=app/config/parameters.yml — File viewer!

The /_profiler/open endpoint reads arbitrary files from the server's filesystem, exposing database credentials, API keys, secret tokens, and AWS keys.