Build an HTTP Proxy to Abuse SSRF [HackTheBox - Response]
In Response from HackTheBox, there's a point where I have to abuse an API endpoint to get SSRF into the inner network that I can't access directly. I'll write a Python Flask application that works as a HTTP proxy so that these requests work while Firefox doesn't know it's working through the SSRF.
Response Writeup: https://0xdf.gitlab.io/2023/02/04/htb...
☕ Buy Me A Coffee: https://www.buymeacoffee.com/0xdf
[00:00] Introduction
[01:10] Overview of different sites
[02:35] Digests
[03:46] Getting digest by abusing cookie
[05:15] Proxy strategy
[06:20] Structural diagram
[08:26] Creating basic Flask application
[09:30] Creating default route
[11:09] Code to hit /fetch
[14:30] get_digest function
[17:30] Setting up Burp to forward to proxy
[18:16] Testing, catching a couple errors, starting to work
[20:30] Decoding responses, proxy works for most GETs
[22:35] Adding mimetype for CSS, JS
[27:35] Adding support for POST
[33:29] Logging in, chatting, things are working
[34:00] Summary