webPromedium
Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API
hackadvisor
Task: NetPulse monitoring platform with internal Agent API protected by IP-based authentication behind nginx; script-type data sources execute shell commands with unsanitized parameters. Solution: spoof source IP via X-Forwarded-For: 127.0.0.1 to access agent API, then inject OS commands through poller_id parameter in script data source execution to read /root/flag.txt.
$ ls tags/ techniques/
command_injectionrcenodejsshell_injectionx_forwarded_forip_spoofingnginxexpressinternal_apihoneypot_flagpolling_agentip_based_auth_bypass
internal_api_abusehoneypot_flag_detectionip_spoofing_via_x_forwarded_for_headerip_based_authentication_bypasscommand_injection_via_unsanitized_parameterscript_data_source_exploitation
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 59 — NetPulse — RCE via Command Injection in Network Diagnostics— hackadvisor
- [web][Pro]Lab 97 — UptimePulse — SSRF Chain to RCE via Cloud Metadata— hackadvisor
- [web][Pro]Lab 120 — InfraPulse— hackadvisor
- [web][Pro]Lab 384 — DevPulse — RCE via AI Log Assistant Prompt Injection— hackadvisor
- [web][Pro]Lab 275 — GatewayPulse — Proxy ACL Bypass via Path Case Normalization— hackadvisor