Lab 90 — InsightDash — SSRF via Avatar Proxy Endpoint

hackadvisor

Task: Node.js/Express monitoring platform with avatar proxy endpoint forwarding to internal Gravatar-compatible service. Solution: Double URL-encoding to inject Gravatar d= parameter, causing internal service to fetch /admin/config and return sensitive configuration with the flag.

ssrf nodejs nginx express internal_service gravatar double_url_encoding avatar_proxy query_injection parameter_injection

internal_service_enumerationdouble_url_encoding_bypassquery_parameter_injectionssrf_via_proxygravatar_default_parameter_abuse

$ ls tags/ techniques/

ssrf nodejs nginx express internal_service gravatar double_url_encoding avatar_proxy query_injection parameter_injection

internal_service_enumerationdouble_url_encoding_bypassquery_parameter_injectionssrf_via_proxygravatar_default_parameter_abuse

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ grep --similar

Similar writeups

[web][Pro]Lab 218 — InsightDash — Web Cache Deception via URL Parser Discrepancy— hackadvisor
[web][Pro]Lab 56 — DataPulse — XXE to SSRF via SVG Avatar Upload— hackadvisor
[web][Pro]Lab 93 — LinkRadar— hackadvisor
[web][Pro]Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API— hackadvisor
[web][Pro]Lab 287 — InsightFlow — SSRF via Host Header Routing and IP Spoofing— hackadvisor