[h2m0nRe-d0b1e]

hello! some any hints

[h2m0nRe-d0b1e]

Actually, the challenge is to get a private url through the vuln of the ssrf type, on a running docker it looks like this:
```
/app # curl localhost:1337/debug/environment
{"Environment variables":{"FLAG":"HTB{f4k3_fl4g_f0r_t3st1ng}"
```
But trust only local ip, ofcourse XFF don't work/

I think exploitation proxy redirect in this variable `target_url = f'http://{SITE_NAME}{url}'`. And this need tricks.

[h2m0nRe-d0b1e]

Oh, I see log got it ?url=@ , but response block this rules RESTRICTED_URLS = ['localhost', '127.', '192.168.', '10.', '172.']
Upd\ get local address some else and done

[nighteliteace]

Any updates, did you manage to do it?

[h2m0nRe-d0b1e]

Any updates, did you manage to do it?

Yes, I did. There is already practically a solution here, there are tips and tricks.

[nighteliteace]

Any updates, did you manage to do it?

Yes, I did. There is already practically a solution here, there are tips and tricks.

Can you give me any hints oh now to bypass SITE_NAME prefix?

[ChromaD4rkn3ss]

Any updates, did you manage to do it?

Yes, I did. There is already practically a solution here, there are tips and tricks.

Can you give me any hints oh now to bypass SITE_NAME prefix?

check this out: https://github.com/swisskyrepo/PayloadsA...ombination