Academy Server-Side Attacks - Skills Assessment

HTB Content Academy
,
24

I didn’t expect it either.

25

BTW ‘window.location.host’ needs to be replaced by the target’s IP, took me too long to figure that out

2 Likes
26

Yes, this is the first skill assessment of all time, which seemed to me a little strange and stands out from the rest of the assessments.

Guys, who passed this module, I still have a question from the section - “SSTI Exploitation Example 3”
I passed it through - tplmap, but couldn’t beat it through a self-contained payload.
I’ve tried a bunch of different options, tried encoding and decoding, and using all sorts of tricks.
But not one did not work.
Please tell me how to modify the script correctly so that it works.
I will be very grateful for your help.

1 Like
27

Did you managed to do it ? Can you share how your payload looks like ?

1 Like
28

Nop, alas, I couldn’t beat it.
I can send my attempts at manual payload to the pm.

29

DM if you are still interested in the example 3 script.

1 Like
30

That was funny. Took me a while to figure out the SSTI wasn’t involved in it. :sweat_smile:

1 Like
31

This whole challenge doesn’t make sense at all, not related to the module

32

This was a silly skill assessment - very ctf-like and not realistic.

Here are some hints for future people stuck on this:

  1. Check the source code for a .js file.
  2. Execute one of the functions in developer options and look at the network tab
  3. Use one of the server-side attacks taught in the module to exploit it (don’t overthink it)
1 Like
33

Hi,
I have the solution already. But there is no file /static/jquery.js. Is this filename just an example and I should dig deeper to find it?
Thanks

34

Looks like this module has been updated and doesn’t require anything like before. The skills assessment was pretty straightforward. Still need help?

35

OK, then it makes sense. No more help needed.

36

I need help. Give me a hint

1 Like
37

Sure. Where are you stuck?

38

On skill assessment

39

Ok. But what part of it? Don’t want to give away the entire process. Just want to nudge you in the right direction where you are stuck.

40

Please give me some hint to start because I don’t know what I should do as I have applied what I have learned throughout the module.

41

Ok. Ensure you have Burp proxy open/set before going to the website. Then, go to the website and check Burp for any interesting requests that you can test for SSRFs. This should get you going.

42

Thank you! Finally finished the module.

43

Anytime :blush:

1 Like