# fast-hook

## fast-hook - Unbreakable

| Info       | Details |
| ---------- | ------- |
| Category   | MISC    |
| Difficulty | Easy    |

## Challenge Overview

This challenge is a MISC one so we're given a server which we should connect using **NC**.

But we can also connect on the browser and see this message:

> **Enter a URL (must start with <https://cyber-edu.co>): Invalid URL. Must start with <https://https://cyber-edu.co>**

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FMEQ8Tkk9HWAYmRee88Aq%2Fgoogle%20image.png?alt=media&#x26;token=c4b0bc7e-f8d7-4a0d-bfc2-ef714ca09b5c" alt="" width="563"><figcaption></figcaption></figure>

Using **@**, I managed to find that there is a **Server Side Requst Forgery Vulnerability**. The site that I tried to be redirected to was **google.com**, so I entered **<http://35.246.235.150:31336@google.com>** and worked. That means the server create a request to **google.com** and possibly sending some useful information.

Using **nc** I connected to the server and get the same message: **Invalid URL. Must start with <https://cyber-edu.co>**

So I tried different payloads to make the server create a request to my **webhook**. (**webhook.site**) **Note:** **Webhook** is a URL provided by a service that automatically receives HTTP requests (usually POST) when an event happens.

Appearently, the script blocks the **"@"** sign because we get this message when we try to redirect it to our **webhook**

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FOZNT6EnKITwyfgOy6VEy%2FScreenshot_1.png?alt=media&#x26;token=f8e59db8-0947-4242-8c08-7f0b79766f22" alt=""><figcaption><p>@ should be bypassed</p></figcaption></figure>

After some tries I realized that the solution to bypass it was to add a **space** before **"@"**, like that.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FxZfaAazs8xe5s3DbUT46%2Ffinished.png?alt=media&#x26;token=56252b9e-054b-46d9-8385-d4766d03efdf" alt=""><figcaption><p>status 200 :)</p></figcaption></figure>

We get the **status code 200**, and it indeed sent the **flag** to the **webhook**.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2Fs9rk3haofTV925puV9wI%2Fflag.png?alt=media&#x26;token=798b2cbe-0351-4366-940b-9bee35450421" alt=""><figcaption><p>final flag</p></figcaption></figure>

## Final Flag

`ctf{75421c31eee55eafbf2d1f34fcfd60c2ab3b203f95633ab4d520b524c8532ad0}`&#x20;

*made by k0d*
