dev.inlanefreight.local
Just a login page. But its a dev page so we gotta dig deeper. I tried SQL injection attacks but didn't work.
Sub-directory Brute Force
The uploads .php and directory caught my attention. It show code 200 for the .php page but when I try to open it I get 403 forbidden. Which is weird so I open it in burp.
HTTP Verb Tampering
Using OPTIONS we see that the following options are allowed.
I tried all of them and only POST, TRACKS seem to work. Apparently TRACK option shows us that X-Custom-IP-Authorization: header is set in the HTTP response.
Adding this option to our request and sending it gives us an interesting webpage that says 'development mode'
Opening it in browser gives us the option to uplaod files. Only images are allowed.
The restriction can be bypassed by changing the file content type header field and we are able to upload the shell. And we get RCE.
Sadly this is out of scope :(
I wanted a reverse shell so I started a listener and ran this:
Last updated