Offlinea

hackthebox

Task: Access a Flask backend protected by localhost-only restrictions behind a PHP frontend. Solution: Bypass SSRF protection via HTTP Parameter Pollution (PHP uses last param, Flask uses first), exploit Python .format() string injection on stored URLs to leak SECRET_KEY from app config, forge admin JWT, and access the protected /bartender endpoint via SSRF.