HTB Server Side Attacks Skills Assessment
Hi everybody, in this post i’ll guide you through the skills assessment of the HTB Server-Side-Attacks module.
The target system is “Flavor Fusion Express”
After clicking for too many times on the “menu/reviews/contact” buttons i finally understood that those are fake , so i moved on.
Get Rolland Dollidze’s stories in your inbox
Join Medium for free to get updates from this writer.
By scrolling down the page i got to the trucks location sections
I understood that this part of the page must be dynamic, so i checked on ZAP if i could find some POST or GET requests that gives value to the truck location. I soon found that the site asks another site about the location: “truckapi.htb”.
From here i tried SSI SSTI and XSLT payloads in order to get errors from the server and undestand what i was dealing with. Soon i understood that the third pary server uses a template language, so i tested the variouse combination of payloads to identify the tamplate language in use by the server “I follow the graph previously shown in the module”
At the end Twig was the used template language and with that knoladge i easly got the flag with the payload
{{['cat%20flag.txt']|map('system')}}I also took the extra step of enumerating the website’s ports and directories to expand the attack surface, but this approach didn’t lead to anything useful.
