githubEdit

Tanuki

Level: Easy Points: 10 Type: Daily Challenge

Lab Interface

The interesting request is for the stats page

Possible SSRF

I tried editing the url parameter.

Only port 3000 is allowed.

After little bit of tinkering: http://localhost:3000/admin revealed the admin panel and flag.

Last updated