Pdfy Htb Writeup Upd Instant

Enter your ngrok URL into the PDFy web form (or send a POST request to /api/cache with the URL). The wkhtmltopdf backend will fetch your page, follow the iframe directive, and attempt to render file:///etc/passwd .

Securing applications that dynamically generate documents from user URLs requires a strict zero-trust posture:

The PDFy challenge is an excellent introduction to SSRF attacks and the risks associated with wkhtmltopdf . By exploiting , we were able to force the PDF converter to leak the server’s /etc/passwd file and retrieve the flag. Whether you use a direct HTML <iframe> or a PHP header redirect, the core concept remains the same – abuse the tool’s ability to follow embedded or redirected URLs to access local resources. pdfy htb writeup upd

All that's left is to deliver the payload. We use Burp Suite or the application's interface to send a POST request to /api/cache with our crafted URL:

We can use John the Ripper to crack the hashed password: Enter your ngrok URL into the PDFy web

wkhtmltopdf is a popular open‑source tool that renders HTML into PDF using the Qt WebKit engine. Versions prior to 0.12.6 are vulnerable to a Server‑Side Request Forgery (SSRF) attack, officially tracked as .

By digging through standard locations (or using the SSRF to scan ports), we find that there is an internal API or service running on a non-standard port (often on this specific box). Change your exploit.php to: Use code with caution. By exploiting , we were able to force

Server-Side Request Forgery (SSRF) via Local File Inclusion (LFI) Target Component: wkhtmltopdf backend rendering engine Phase 1: Information Gathering & Enumeration 1. Analyzing the Frontend Interface

First, start a simple PHP web server on your local machine:

PDF metadata reveals usage of wkhtmltopdf , a utility prone to Local File Inclusion (LFI) and SSRF, which executes scripts on the server. While direct file:///etc/passwd inputs are blocked by input filters, an SSRF redirection bypass allows accessing local files. Phase 3: Exploitation via Redirection Bypass

chmod