The Hidden Link: Reading an Invisible Link From View Source
The challenge
This account page looks like an ordinary customer page. But the page ships more than it shows: there is a link in the HTML that is set to stay invisible. Open View source, find the hidden link, and submit the page address it points to.
What you'll learn
- Open a web page's View source for the first time
- Understand that a page sends more to the browser than it draws on screen
- Find a link that was set to stay invisible in the HTML
- Read the address a link points to from its source
- Explain why hiding something on screen does not make it private
Skills tested
Prerequisites
- Knowing how to right-click a page and choose View source
- Basic idea that web addresses look like /something
How it works
When you load a web page, the server sends your browser a block of text called HTML. The browser reads that text and draws the page you see. But it does not draw everything: a developer can mark an element to stay invisible, and the browser will simply not paint it. The element is still there in the text - it just is not shown.
You can read the original text for any page by opening View source (right-click the page, then choose "View page source", or use the browser menu). This shows the HTML exactly as it arrived, including elements that were hidden from view. In this challenge there is a link marked invisible that points to /admin-old, an old staff page. You never see it on screen, but it is plainly there in the source.
The takeaway for beginners is simple and important: making something invisible on the page is a display choice, not a way to keep it secret. Everything the page is built from - links, text, notes - travels to your browser and can be read. If a page contains a link to a private area, hiding it does nothing to stop someone from finding it in the source.
Common mistakes
- Only looking at the visible page. Reading what is drawn on screen and assuming that is all the page contains.
- Thinking invisible means deleted. Believing a hidden link is gone, when it is still in the HTML.
- Submitting the wrong text. Typing the word shown for the link instead of the address it points to.
- Getting lost in the source. Skimming too fast and missing the one link that is not drawn on the page.
How to defend against it
Do not rely on hiding things on screen to keep them private. If a page or area should be restricted, the server must actually require permission to reach it - not just leave the link out of view.
- Remove links to old or internal pages from public pages instead of hiding them.
- Protect private pages on the server so they refuse visitors without permission, even if someone finds the address.
- Take down old pages like
/admin-oldrather than leaving them reachable. - Treat everything in the HTML as readable by anyone, because it is.