[skalvin]

after using

php -S 127.0.0.1:8000

where we should host our html and flag.php in which path location if we are using KALI

[macavitysworld]

after using

php -S 127.0.0.1:8000

where we should host our html and flag.php in which path location if we are using KALI

This command starts the PHP built-in server and serves the files from the current directory.

/path/to/your/directory
├── index.html
└── flag.php

[skalvin]

I've follow your steps but there's a problem

when you use ngrok with http as you said the redirect page will land on warning
and when we use the tcp we got link for ngrok tcp:// and the link cannot be access with http so how to solve this issue?

can you explain more how to do it via tcp

after using

php -S 127.0.0.1:8000

where we should host our html and flag.php in which path location if we are using KALI

This command starts the PHP built-in server and serves the files from the current directory.

/path/to/your/directory
├── index.html
└── flag.php

[macavitysworld]

I've follow your steps but there's a problem

when you use ngrok with http as you said the redirect page will land on warning
and when we use the tcp we got link for ngrok tcp:// and the link cannot be access with http so how to solve this issue?

can you explain more how to do it via tcp

after using

php -S 127.0.0.1:8000

where we should host our html and flag.php in which path location if we are using KALI

This command starts the PHP built-in server and serves the files from the current directory.

/path/to/your/directory
├── index.html
└── flag.php

When you forward using ngrok, you will get something like this. 

Forwarding                    tcp://0.tcp.in.ngrok.io:13367 -> 127.0.0.1:8000

change the tcp protocol to http.

http://0.tcp.in.ngrok.io:13367/

Like this. If you are wondering why it works?
That is because HTTP is a Protocol over TCP,  Since HTTP requests are just formatted TCP packets, as long as ngrok is forwarding the TCP traffic correctly, HTTP clients (like web browsers) can communicate using HTTP over this TCP connection.

[skalvin]

Thanks for your reply and your help

the thing make me confuse is when i test the ngrok link local i get "This site can’t be reached"

when i put the link on pdfy site i success to the HTTP request via the TCP forwording

127.0.0.1 - - [10/Jul/2024 12:30:19] "\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x037j" 400 -
127.0.0.1 - - [10/Jul/2024 12:30:49] "GET /Desktop/ HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:30:49] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:23] "GET /Desktop/ HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:23] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:53] "GET /Desktop/index.html HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:53] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -

but still not have the flag the pdf is empty 

---

When you forward using ngrok, you will get something like this. 

Forwarding                    tcp://0.tcp.in.ngrok.io:13367 -> 127.0.0.1:8000

change the tcp protocol to http.

http://0.tcp.in.ngrok.io:13367/

Like this. If you are wondering why it works?
That is because HTTP is a Protocol over TCP,  Since HTTP requests are just formatted TCP packets, as long as ngrok is forwarding the TCP traffic correctly, HTTP clients (like web browsers) can communicate using HTTP over this TCP connection.

Thanks for your reply and your help

the thing make me confuse is when i test the ngrok link local i get "This site can’t be reached"

when i put the link on pdfy site i success to the HTTP request via the TCP forwording

127.0.0.1 - - [10/Jul/2024 12:30:19] "\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x037j" 400 -
127.0.0.1 - - [10/Jul/2024 12:30:49] "GET /Desktop/ HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:30:49] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:23] "GET /Desktop/ HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:23] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:53] "GET /Desktop/index.html HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:53] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -

but still not have the flag the pdf is empty 

[macavitysworld]

Thanks for your reply and your help

the thing make me confuse is when i test the ngrok link local i get "This site can’t be reached"

when i put the link on pdfy site i success to the HTTP request via the TCP forwording

127.0.0.1 - - [10/Jul/2024 12:30:19] "\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x037j" 400 -
127.0.0.1 - - [10/Jul/2024 12:30:49] "GET /Desktop/ HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:30:49] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:23] "GET /Desktop/ HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:23] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:53] "GET /Desktop/index.html HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:53] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -

but still not have the flag the pdf is empty 

---

When you forward using ngrok, you will get something like this. 

Forwarding                    tcp://0.tcp.in.ngrok.io:13367 -> 127.0.0.1:8000

change the tcp protocol to http.

http://0.tcp.in.ngrok.io:13367/

Like this. If you are wondering why it works?
That is because HTTP is a Protocol over TCP,  Since HTTP requests are just formatted TCP packets, as long as ngrok is forwarding the TCP traffic correctly, HTTP clients (like web browsers) can communicate using HTTP over this TCP connection.

Thanks for your reply and your help

the thing make me confuse is when i test the ngrok link local i get "This site can’t be reached"

when i put the link on pdfy site i success to the HTTP request via the TCP forwording

127.0.0.1 - - [10/Jul/2024 12:30:19] "\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x037j" 400 -
127.0.0.1 - - [10/Jul/2024 12:30:49] "GET /Desktop/ HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:30:49] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:23] "GET /Desktop/ HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:23] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:53] "GET /Desktop/index.html HTTP/1.1" 200 -
127.0.0.1 - - [10/Jul/2024 12:31:53] "GET /Desktop/flag.php?x=/etc/passwd HTTP/1.1" 200 -

but still not have the flag the pdf is empty 

DM me on tg @macavitysworld

[hooneyman]

Thanks for share! interesting!!!  <3

[Pegasus505]

for the people wondering , No this method does'nt work if you host the files on github.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Reposting for credits

[cavour13]

i loved this chall

[charliexox]

Hmm thanks for sharing ...
Wondering why there is needed intermediate step like a index.html, why you cannot just go to http://SERVER_IP/flag.php?x=/etc/passwd
why it should be used in iframe, I know that it"s not work, but why ?