TryHackMe Surfer Writeup

As information states, there is web app running so doing nmap is a waste of time. Let’s directly jump into port 80.

So there is a login page. Whenever I visit any website, I first check two directories

/robots.txt and /sitemap.xml

Because if they exit they always lead some path.

I got /backup/chat.txt file. It states that stop using username as password, means username and password are same, which makes easy for us to bruteforce the login page.

I tried admin : admin and got successful.

Recent activity says : Internal pages hosted at /internal/admin.php. It contains the system flag. So we have to access it.

The word locally slightly leads us towards SSRF as we can make internal connection to localhost(127.0.0.1) via SSRF.

On clicking export to pdf, it downloads the file which may be coming from third party website, So intercepted the “export to pdf” request using Burpsuite.

I changed the url and tried to acces /internal/admin.php.

After forwarding I got the flag yay!!!.

If you think how I learnt about it, I followed

https://portswigger.net/web-security/learning-paths/ssrf-attacks

Thanks For reading. Please do follow, clap and comment if there is any doubt.