EasySchema
EasyWeb Security
Overview
The server will happily fetch any URL you give it… well, almost any.
There’s a flag waiting at /app/flag.txt, but a strict filter is standing guard. Can you slip past its rules and grab the prize?
flag format: Flag{}
Lab Details
Prerequisites & Requirements
- Basic understanding of web application security concepts
- Knowledge of HTTP requests and responses
- Familiarity with SSRF (Server-Side Request Forgery) vulnerabilities
- Understanding of URL schemes and protocols
What will you learn?
- How to identify and exploit SSRF vulnerabilities in web applications
- Understanding of the node-libcurl package and its protocol support
- File URI scheme variations and their security implications
- Bypassing blacklist-based security filters using protocol specification nuances
Tools
- Web browser (Chrome, Firefox, etc.)
- Webhook service (webhook.site, Burp Collaborator, or similar)
- HTTP request interceptor (Burp Suite, OWASP ZAP, or browser developer tools)
Job Positions
Penetration Tester
Tags
SsrfLfiInput ValidationWaf BypassLogic Flaws