webPromedium
Lab 282 — StreamForge — SSRF via Webhook Test Bypasses Proxy Auth
hackadvisor
Task: StreamForge monitoring dashboard has nginx proxy blocking /admin/* endpoints, but a webhook test feature allows full-read SSRF with response body returned. Solution: use SSRF to scan localhost ports, discover gunicorn backend on port 3001 behind nginx (port 8080), hit /admin/system-config directly on backend bypassing proxy auth to retrieve the flag from master_key field.
$ ls tags/ techniques/
flaskssrfinformation_disclosurenginxrobots_txtgunicorninternal_servicewebhookadmin_bypassproxy_bypasshttp2honeypot_flag
honeypot_flag_detectionssrf_via_webhook_testnginx_proxy_bypass_direct_backendinternal_port_scanning_via_ssrf
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 205 — DockForge — SSRF in Webhook Test Endpoint— hackadvisor
- [web][Pro]Lab 315 — PulseMetrics — SSRF Chain to SSTI via Internal Services— hackadvisor
- [web][Pro]Lab 273 — AuthForge — SSRF via OAuth Dynamic Client Registration— hackadvisor
- [web][Pro]WebhookForge— hackadvisor
- [web][Pro]Lab 340 — PingRelay — Blind SSRF via Webhook Test— hackadvisor