ufu6 - SMP CTF 2024 - Selection Round

Hi, this is Parvez Mosharaf Siam. Again I am here with a write-up on behalf of our teammate badhacker0x1. So, without any further delay, let's jump into the write-up.

Description:- I'm trying to build something. Please check if there is anything wrong.

Challenge URL:- http://172.104.185.76:5001/

The challenge page says to enter a url. ummmm smelling like some server side issue. Lets explore.

There is a comment in the html code we got a port number 7979 lets take a note of this.

Try to enter a random url like evil.com and this says only google domains are allowed.

Lets try with https://google.com. Its fetching the headers. Nice!!

Remember we found a port number in the comment. Maybe there is a webserver running on that port locally lets try to fetch that.

No luck! maybe somehow we need to bypass this. Lets try with ipv6 as the challenge name is ufu6.  In IPv4, the loopback address is 127.0. 0.1, while in IPv6, it is 0:0:0:0:0:0:0:1 or ::1. Lets try

Bypass Localhost with IPv6 Notation.

Final payload: http://[::1]:7979