2

I`m trying to perform a SSRF attack on a Hack The Box machine (editorial.htb). I'm trying to send a POST request using curl with the command

curl --data "hckyou.txt" -X POST http://editorial.htb/upload

The POST request in "hckyou.txt" is the following"

POST /upload HTTP/1.1
Host: editorial.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------246068047919283104132964618623
Content-Length: 691
Origin: http://editorial.htb
Connection: keep-alive
Referer: http://editorial.htb/upload

-----------------------------246068047919283104132964618623
Content-Disposition: form-data; name="bookurl"

http://127.0.0.1:5000
-----------------------------246068047919283104132964618623
Content-Disposition: form-data; name="bookfile; filename =""
Content-Type: application/octet-stream

111
-----------------------------149682616639422075182982487158
Content-Disposition: form-data; name="bookintro"


-----------------------------149682616639422075182982487158
Content-Disposition: form-data; name="whyus"

aa@aa
-----------------------------149682616639422075182982487158
Content-Disposition: form-data; name="email"

111111
-----------------------------149682616639422075182982487158
Content-Disposition: form-data; name="phone"

But the host answer to the request is the following:

<!doctype html>
<html lang=en>
<title>400 Bad Request</title>
<h1>Bad Request</h1>
<p>The browser (or proxy) sent a request that this server could not understand.</p>

Has anybody any idea about what's wrong on my request? This is driving me crazy...

Improve this question
3
  • 4
    The --data argument of curl is expected to be the request body only, not the full request including request header like you did. Commented Jul 23, 2024 at 5:32
  • 1
    Some of the boundaries also don't match the boundary definition in the header. If this is intentional, that's fine; it doesn't affect the validity of the request. The parts will be interpreted as a single big part. Commented Jul 24, 2024 at 5:46
  • I separated both header and data, and used the same boundary values.. but no luck. It just doesn't understand the request :( Commented Jul 25, 2024 at 1:12

0

Reset to default

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.