Lab 93 — LinkRadar

hackadvisor

Task: LinkRadar website monitoring platform with URL preview feature protected by IP blocklist — SSRF via IPv6-mapped IPv4 bypass. Solution: Discovered internal metrics API (port 3001) from JS comment, bypassed IPv4 blocklist using [::ffff:127.0.0.1] notation, enumerated internal endpoints, and retrieved flag from /flag endpoint.

ssrf nodejs nginx express internal_service decoy_flag url_validation blocklist_bypass ipv6_mapped_ipv4 headless_browser url_preview

ipv6_mapped_ipv4_bypassurl_validation_bypassinternal_service_enumerationdecoy_flag_avoidanceresponse_body_exfiltrationssrf_via_url_preview

$ ls tags/ techniques/

ssrf nodejs nginx express internal_service decoy_flag url_validation blocklist_bypass ipv6_mapped_ipv4 headless_browser url_preview

ipv6_mapped_ipv4_bypassurl_validation_bypassinternal_service_enumerationdecoy_flag_avoidanceresponse_body_exfiltrationssrf_via_url_preview

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ grep --similar

Similar writeups

[web][Pro]Lab 98 — SprintDeck — SSRF via Link Preview URL Filter Bypass— hackadvisor
[web][Pro]Lab 256 — UptimeRadar — SSRF via URL Health Check— hackadvisor
[web][Pro]Lab 91 — PingRadar — SSRF Filter Bypass via Open Redirect Chain— hackadvisor
[web][Pro]Lab 97 — UptimePulse — SSRF Chain to RCE via Cloud Metadata— hackadvisor
[web][Pro]Lab 6 — HookRelay — SSRF via IPv6-Mapped-IPv4 Bypass— hackadvisor