> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2021/norzhctf-2021/triskel-1-first-contact.md).

# Triskel 1: First Contact

Server-side Request Forgery (SSRF)

## Problem

Coronavirus affected our airport so much that our dev team developed an app to keep track of it! I mean they didn't have much time to make it, but what could go wrong?

by Remsio

## Solution

Pivoting from the previously found IP address, we scan this IP address to find that there is a HTTP service running on it.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-4ab305f821d37e2a2ed0358b8846fc75c81818cf%2Ffffd100ad9b0471c974126dabee947d9.png?alt=media)

This seems to be the app that the challenge is talking about.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-1096521a5cf36178e5d5d3e87e8dfc1abdea1d1f%2Fe29ab5737d7e49fb9e265bf699eb4ce9.png?alt=media)

While fuzzing the input, I found that it uses curl.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-16dc00c5c1db4120b2905635d0b36fc1b7be5b11%2F80da5f1a23214b5590258a5ad3121589.png?alt=media)

Additionally, it appears that the IP address in the URL is checked against a whitelist of allowed IP ranges. These were 10.0.0.0/24, 10.0.42.0/24, and 10.0.43/24.

We can run a Burp intruder scan to find out what other hosts we can connect to through `10.35.2.134/call_api.php`.

Indeed, on scanning the `10.0.42.0/24` network, we find `10.0.42.2` and `10.0.42.200` is a valid endpoint.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-49e12394d8c4bbf8023f04404cd17db585e36c44%2Fac58c875d75641f49253c08bf7481749.png?alt=media)