Looking Glass

Platform: webkids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: apache_server_status_leak, ssrf_localhost_bypass, zero_address_bypass

Summary

Task: SSRF in a proxy/bypass tool with localhost filter. Solution: Bypass filter using 0.0.0.0 to access Apache /server-status and extract the flag.

Looking Glass — Web Kids 2.0

Description

"Wow! Look at this great RKN bypass tool I found"

The web application is a proxy/bypass tool that accepts a URL and makes a request to it.

Analysis

The application has a ?url= parameter that is vulnerable to SSRF (Server-Side Request Forgery). However, direct access to localhost (127.0.0.1) is filtered. We need to find a way to bypass the filter to access internal server resources.

Key observations:

• The url parameter accepts arbitrary URLs
• The filter blocks 127.0.0.1 and localhost
• The server runs on Apache (has /server-status endpoint) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Discovering SSRF

The application accepts a URL via GET parameter and makes a request to it:

http://109.233.56.90:11501/?url=http://example.com

Step 2: Bypassing localhost filter

Direct access to 127.0.0.1 is blocked, but 0.0.0.0 is not. On Linux, 0.0.0.0 resolves to localhost:

http://109.233.56.90:11501/?url=http://0.0.0.0:80/

Step 3: Accessing Apache server-status

Apache has a default /server-status endpoint that shows information about current requests:

http://109.233.56.90:11501/?url=http://0.0.0.0:80/server-status

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Extracting the flag

The /server-status output displays internal server requests, which contain the flag.

Alternative localhost filter bypass methods

• 0.0.0.0 — resolves to localhost on Linux
• 127.0.0.1 in various formats: 127.1, 127.0.1, 2130706433 (decimal)
• IPv6: ::1, [::1], 0:0:0:0:0:0:0:1
• DNS rebinding: domain resolving to 127.0.0.1
• URL encoding: %31%32%37%2e%30%2e%30%2e%31 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍