Webverselabs Challenge Statuscraft SSRF

Scenario :

Statuscraft is a two-engineer side project out of Berlin, founded in 2022 as a hobbyist alternative to Statuspage — drop in a URL, get a status page, pipe outages to Slack. Hobby tier is free, the team tier is €9/month, and the self-hosted build ships next month. The add-monitor form shows you the first ping inline so you can sanity-check the response before committing the monitor; the engineers built it in a weekend and never came back to harden it.

Solution :

First, we need to create an account to explore the app further.

Once we login, we find 2 new endpoints, and the possibility to add a monitor, i checked the other endpoint but /Incidents only returned a static web page .

And Looking at the burp request , there is nothing useful there too.

Now back to our /monitors endpoint , we can try to add a new monitor and see what Requests are made to the server when we do so.

First i added the Url for our Webhook Site :

This didn’t work for whatever reason , but looking at Burp :

We first will try to use a different URL like google.com and see if we can make the server fetch that.

We get a redirect but once again we dont get the ping, maybe it can’t reach external IP addresses.

But what if we specify an internal IP address like localhost ? will it work?

At first i tried the common ports for web apps to see if we get any different result , i tried 443,8000,8080,80.

Port 443 and 80 returned the same response as before. But when i tried 8080 :

If we follow the redirection :

Perfect , this proves that port 8080 is indeed open.

now we can try an internal port scan , for this we can either use FFUF or Burp’s Intruder , i always use FFUF in my writeups so let’s use Intruder this time.

First , send the POST Request to Intruder and specify the Port as the variable :

Then paste the listt of ports you want to test , i used the most common ones .

Before we start the attack , since ALL the request are a Redirection , we need to tell Intruder to Follow redirections otherwise we can’t filter anything . (Settings –> Redirection –> Always)

Then finally we just start our attack .

From there we filter based on the Content of the Response , for each response we will have Response 1 which is the same across all requests since that’s just the redirection , and the Reponse 2 which is after we follow the redirection .

Here I’m looking for a response that has similar lebght to the response for 8080 .

We find Port 5000 is also UP and running .

I didn’t notice it earlier but the flag was in the Response for 8080 not 5000 -_-

But anyways we manage to try Internal Port scanning via SSRF .

That was all for this challenge. See you in the next one :)