[paven]

DoxPit - Web - Medium

Good luck everyone! Let's tackle this together!
https://app.hackthebox.com/challenges/DoxPit

[pwns4k3]

Any1 progressing? Where the vulnerability in front-end is? TypeScript and React make it hard for me

[ZeetaOnline]

no progress yet!!

[cavour13]

Got it!! you have to think really outside the schemas! foothold is to try ssrf with a particular preflight condition! then is pretty easy if you are familiar with all payloads! i personally stuck to how to interact with the backend which is quite simple if you see the front-end part !
Basically front can bring you to backend

See you on other webchallenges

[Art10n]

Any hint for steps in this challenge

[mazafaka555]

solved this chall and open for trades with something i miss. see ya.

[Art10n]

stucked in ngrok redirect --> trying to do post (host, next-action, referer) stops in ngrok server https and i cannot create user

[mazafaka555]

use `ngrok tcp 80` or https://github.com/ekzhang/bore

[0x00b]

thx for sharing dude

[xxxbfacc]

The backend app is python with a SSTI.
You can't use characters {{ }} [ ] . _ or x
hacktricks has payload like, which is close, but still uses x:

{%with a=request|attr("application")|attr("\x5f\x5fglobals\x5f\x5f")|attr("\x5f\x5fgetitem\x5f\x5f")("\x5f\x5fbuiltins\x5f\x5f")|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('ls${IFS}-l')|attr('read')()%}{%print(a)%}{%endwith%}

You can modify this to work without the character x if you get creative.