Extract secret keys via SSRF, using the blog API for send requests from the server to internal services.

1. Explore blog API endpoints
2. Exploit the vulnerable endpoint
3. Navigate along internal service endpoints
4. Extract the secret keys from the internal service

Tools

• Burp Suite
• DirBuster

Resources

Use the dirlist.txt dictionary.

Tips

• The flag (secret key) is written inside an image

Usage

Run container

docker run -it --name bogota -p 9999:9999 ghcr.io/platzi/ctf-bogota:main

Show logs of container

docker logs --follow bogota

Stop container

[Ctrl]+[C]
// or in other tab
docker stop bogota

Remove container

docker container rm bogota

Remove image

docker rmi ghcr.io/platzi/ctf-bogota:main