webPromedium
DeployVault — Path Confusion to SSRF Chain
hackadvisor
Task: DeployVault deployment platform with nginx reverse proxy blocking admin endpoints and webhook tester with SSRF filter. Solution: Path confusion (/api/docs/../admin/config) bypasses nginx ACL to leak internal service credentials, then IPv4-mapped IPv6 address bypasses SSRF filter to access internal secrets endpoint.
$ ls tags/ techniques/
ssrfpath_traversalinformation_disclosurenginxexpressinternal_servicewebhookreverse_proxypath_confusionhoneypot_flagssrf_filter_bypassipv4_mapped_ipv6
ssrf_via_webhook_testpath_traversal_nginx_express_desyncipv4_mapped_ipv6_filter_bypassadmin_endpoint_bypass_via_path_confusioninternal_service_key_leak
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE— hackadvisor
- [web][Pro]DeployPilot— hackadvisor
- [web][Pro]Lab 393 — ShareVault — Stored XSS via File Browser innerHTML— hackadvisor
- [web][Pro]Lab 347 — PushRelay — SSRF via URL Parsing Confusion in Webhook Tester— hackadvisor
- [web][Pro]Lab 6 — HookRelay — SSRF via IPv6-Mapped-IPv4 Bypass— hackadvisor