Forum Discussion

pcarra1's avatar
pcarra1
Icon for Bronze I rankBronze I
2 months ago
Solved

Server-Side Request Forgery Web App Hacking

I've been banging my head against this for a few hours now and worked my way all the way through to step 7.  I am not able to retrieve /tmp/token.txt.  I've tried modifying the "url" param key and found it throws a 500 for anything I've tried other than "url". I've tried modifying the "url" value to use directory traversal and "///tmp/token.txt", "/tmp/token.txt".  Still no luck.  I've also tried using the original url paths and the bypass I used to view the config file for the bot and I get 404's back.  I think the lab could have an issue? I have screenshots but didn't want to share them unless asked to not reveal any answers. Any help is appreciated.

challenges
  • AtakanBal's avatar
    AtakanBal
    2 months ago

    Hi pcarra1,

    Yes, it’s about modifying the URL value, but not through directory traversal or bypassing filters. There’s another method you can use that involves a different URI scheme other than "http". The briefing section includes an example of this.

2 Replies

  • AtakanBal's avatar
    AtakanBal
    Icon for Bronze III rankBronze III
    2 months ago

    Hi pcarra1,

    Yes, it’s about modifying the URL value, but not through directory traversal or bypassing filters. There’s another method you can use that involves a different URI scheme other than "http". The briefing section includes an example of this.

    • pcarra1's avatar
      pcarra1
      Icon for Bronze I rankBronze I
      2 months ago

      I figured it out..... for the life of me I swear I tried that before posting.  Persistence is key thanks for the reply!