TRYHACKME’S ADVENT OF CYBER 2023 ( DAY 22 )

 

Day 22 - "Jingle Your SSRF Bells: A Merry Command & Control Hackventure"

The learning objectives for day 22 were:

• Understanding server-side request forgery (SSRF)
• Which different types of SSRF are used to exploit the vulnerability
• Prerequisites for exploiting the vulnerability
• How the attack works
• How to exploit the vulnerability
• Mitigation measures for protection

In this task we learned what server-side request forgery is, what the different types of ssrf attacks are, how it works and how to hack the c2 server using ssrf and mitigation measures.

we found a link to an endpoint in the login page and used ssrf to gain access.

Click here to see the tutorial.