https://joaobonin.com/tags/ssrf/ Recent content in Ssrf on João Vítor Moutinho Bonin Hugo en Fri, 22 May 2026 00:00:00 +0000 https://joaobonin.com/posts/htb-editorial/ Fri, 22 May 2026 00:00:00 +0000 https://joaobonin.com/posts/htb-editorial/ SSRF on a book publishing platform leaks an internal API running on port 5000. The API exposes hardcoded dev credentials, landing us a shell. From there, git history reveals prod credentials, and a sudo-allowed GitPython script is vulnerable to ext:: protocol injection — setting SUID on bash and giving us root.