🐀🐀🐀
0 pts earned
API Fetch
Premium Machine (Locked)
🧩 ExposedAPI
🖧 AD Network — ExposedAPI
API Users
🔒 API Profile
🔒 API Auth
🔒 API Admin
API Fetch
POST /api/v1/fetch makes outbound HTTP requests with user-supplied URLs. SSRF against localhost:8080/internal/dump returns an SSH private key. SUID /usr/bin/curl can read local files via file://.
🩸 First user blood: thinkverse
🩸 First root blood: thinkverse
Internal machine — reachable only by pivoting from the entry host. It is not directly scannable from the internet, so external scans return filtered. This is by design, not an outage.
Target IP
Premium required
User Flag
Pending
Root Flag
Pending
