Plain Text Only
Client: Northmoor Utilities, who bill business accounts for metered supply. Engagement: White-box assessment of the self-serve billing portal and the statement production it drives.
Scope
In scope: the billing portal served at this origin, every HTTP endpoint it exposes, the modules it imports, and the statement layout mounted into the application image.
The portal is reached from the per-account link printed on a statement. It carries no sign-in of its own — the link stands in for one, and anyone holding it sees one account and can change the billing details printed at the head of that account's statement.
Out of scope: the rating run that produces the amounts, the tariff catalogue as a commercial artefact, other engagements, and denial of service.
Rules of engagement
Work only against the account this link opens. Northmoor's billing team maintains the statement layout through their own release process and has not given you an account on it; the layout is yours to read, not to change.
Everything you need is reachable from the portal's own pages. Nothing here needs a wordlist, and nothing is behind a password worth guessing.
Objective
The portal makes a promise on the billing details page: what an account holder enters there is stored and printed as plain text, and none of it is read as an instruction to the layout.
Northmoor wants that promise tested. Establish whether a value entered as a billing detail stays a value all the way to the finished statement — and if it does not, show how far it gets.
The proof Northmoor will accept is /flag.txt, a file on the application host that no page of the portal serves and no line of the application reads.
Deliverable
The contents of /flag.txt, and the entry point that produced it.