webProhard

Тссс, 9.2.2.3!

hackerlab

Task: Express 'Site Tester' headless-Chrome scraper with SSRF (stats-only oracle, http/https only). Solution: title 9.2.2.3 = CDP port 9223; host CSP-free attacker JS, fetch CORS-readable /json, open page-level CDP WebSocket, Target.createTarget(file:///app/flag.txt) + Runtime.evaluate to read and exfiltrate the flag.

$ ls tags/ techniques/
ssrffile_readnodejsexpressheadless_chromewebsocketcdpchrome_devtools_protocolremote_debugging_portcsp_artifactport_in_titlecors_readable_cdp
ssrf_internal_port_scancdp_json_endpoint_cors_readcdp_page_websocket_from_browser_jstarget_createtarget_file_readruntime_evaluate_exfilcsp_false_negative_pitfall
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups