webPromedium

Lab 190 — ApiNexus — Proxy Access Control Bypass via URL Path Normalization

hackadvisor

Task: Enterprise API gateway (NexusRoute proxy + Flask backend) blocks /admin/* paths via raw URL prefix matching at the proxy layer. Solution: Double-slash path (//admin/flag) bypasses proxy ACL because it doesn't match the /admin/ prefix, while Flask/Werkzeug normalizes it to /admin/flag on the backend.

flask nginx gunicorn acl_bypass reverse_proxy proxy_bypass path_normalization honeypot_decoy proxy_backend_desync double_slash url_normalization

anti_honeypot_awarenessdouble_slash_path_normalization_bypassproxy_acl_bypass_via_raw_path_matchingflask_werkzeug_path_normalizationapi_info_endpoint_reconnaissance

$ ls tags/ techniques/

flask nginx gunicorn acl_bypass reverse_proxy proxy_bypass path_normalization honeypot_decoy proxy_backend_desync double_slash url_normalization

anti_honeypot_awarenessdouble_slash_path_normalization_bypassproxy_acl_bypass_via_raw_path_matchingflask_werkzeug_path_normalizationapi_info_endpoint_reconnaissance

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub, Discord, or Google to continue. No email required.

$sign in

$ grep --similar

Similar writeups

[web][Pro]Lab 210 — RouteMesh — Broken Auth via Trusted Gateway Headers— hackadvisor
[web][Pro]Lab 275 — GatewayPulse — Proxy ACL Bypass via Path Case Normalization— hackadvisor
[web][Pro]Lab 220 — RouteForge — TE.TE HTTP Request Smuggling via Proxy Header Parsing— hackadvisor
[web][Pro]Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection— hackadvisor
[web][Pro]Lab 375 — PageFlow — Web Cache Deception via Path Normalization— hackadvisor