Lab 340 — PingRelay — Blind SSRF via Webhook Test

hackadvisor

Task: Flask notification platform with webhook testing feature. Solution: SSRF via webhook URL parameter to access internal admin API on localhost:3001, discovered through robots.txt.

flask ssrf information_disclosure robots_txt webhook internal_api

robots_txt_enumerationssrf_via_webhookinternal_service_discovery

$ ls tags/ techniques/

flask ssrf information_disclosure robots_txt webhook internal_api

robots_txt_enumerationssrf_via_webhookinternal_service_discovery

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ grep --similar

Similar writeups

[web][Pro]Lab 47 — PingRadar — Blind SSRF via Webhook Test Delivery— hackadvisor
[web][Pro]Lab 406 — PingRelay — Prototype Pollution to SSRF via CRLF Header Injection— hackadvisor
[web][Pro]Lab 91 — PingRadar — SSRF Filter Bypass via Open Redirect Chain— hackadvisor
[web][Pro]Lab 6 — HookRelay — SSRF via IPv6-Mapped-IPv4 Bypass— hackadvisor
[web][Pro]Lab 347 — PushRelay — SSRF via URL Parsing Confusion in Webhook Tester— hackadvisor