nmap -sC -sV -oA pdfy 10.10.11.xx
Using exiftool :
→ Unsafe concatenation.
Verify SSRF by receiving a "hit" on a controlled listener (like Webhook.site). pdfy htb writeup upd
PDFy is an on Hack The Box (HTB) that centers on exploiting a Server-Side Request Forgery (SSRF) vulnerability in a web-to-PDF conversion service. The goal is to exfiltrate the contents of the /etc/passwd file from the server to retrieve the flag. Challenge Overview Difficulty: Easy Category: Web Primary Objective: Leak the /etc/passwd file. Core Vulnerability: SSRF via a PDF generation library. Walkthrough & Exploitation Steps nmap -sC -sV -oA pdfy 10
To read local files, you need to bypass the URL input filter. The easiest way to achieve this is by using a hosted on your own machine. Instead of giving the application a direct file path, you give it a URL pointing to a script you control. The goal is to exfiltrate the contents of
We then focus our attention on the PDF converter service running on port 8080. After analyzing the service using tools like curl and burpsuite , we discover that it allows users to convert various file formats to PDF. However, we also notice that the service does not perform any validation on user-input files, which could potentially lead to code execution vulnerabilities.