Pdfy: Htb Writeup Upd

To read local files, you need to bypass the URL input filter. The easiest way to achieve this is by using a hosted on your own machine. Instead of giving the application a direct file path, you give it a URL pointing to a script you control.

Use code with caution. Exposing Your Local Web Server

Navigating to the web application, we find a simple interface aimed at converting HTML content into PDF files. This functionality—a "PDF Generator"—immediately flags a high potential for or Command Injection . We explore the pages: index.php about.php contact.php

uname -a

ln -s /etc/passwd /home/pdfy/.pdftotext.cfg

cat /home/robert/user.txt

This walkthrough demonstrates that the most effective way to learn penetration testing is by doing. PDFy is a perfect starting point for beginners to understand the attack surface of web applications and internal services, bridging the gap between theory and practice in a fun, gamified way. pdfy htb writeup upd

The script should redirect the requester to the target local file on the HTB server. Use code with caution. Copied to clipboard

View or download the generated output file. The target file contents will be printed cleanly inside the PDF screenshot structure.

The PDFy challenge is an excellent introduction to SSRF attacks and the risks associated with wkhtmltopdf . By exploiting , we were able to force the PDF converter to leak the server’s /etc/passwd file and retrieve the flag. Whether you use a direct HTML <iframe> or a PHP header redirect, the core concept remains the same – abuse the tool’s ability to follow embedded or redirected URLs to access local resources. To read local files, you need to bypass the URL input filter

To bypass this input filter, you can host a rogue web script on your own infrastructure (VPS or a localized tunneling solution like Serveo). When the HTB server requests your server's public URL, your script will return an HTTP redirection code ( 302 Found ) pointing directly to the internal files. Because the backend engine handles redirections programmatically, it follows the redirected path internally, bypassing the frontend input validation. Phase 3: Step-by-Step Exploitation Step 1: Prepare the Redirection Exploit File

Example RPD format: HTBr00t_pr00f_d4t4_456abc