Hintru Tip ENES ← All labs

Tanuki: Flashcard Backup Restore

EN medium CTF challenge XXEXML External Entityin-band exfiltrationJS bundle reconAPI enumerationDTD injectionarbitrary file read
Original

Tanuki is a flashcard web app with an XML-based deck export and a JSON-driven restore endpoint. The server secretly round-trips your JSON through an XML template with DTD processing enabled — giving you a path to read arbitrary files off the server without any out-of-band channel. Your goal is to exfiltrate the flag at /app/flag.txt entirely in-band.

0/7
solved
Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7
recon

Step 1 · Map the API from the client bundle

Objective: Discover all API endpoints by extracting and reading the minified React JavaScript bundle served by the application.

Context: The app is a React SPA. All client-side API calls are baked into the JavaScript bundle at /static/js/main.*.js. Prettifying and searching the bundle is the fastest way to enumerate every endpoint before touching the app.

Progressive hints

Only reveal the ones you need. Claude tracks how many you used to calibrate the feedback.

Hint 1 — directional nudge

The frontend is a compiled React SPA. Where would all the API endpoint strings live?

Hint 2 — technique / vuln class

Fetch the JS bundle from /static/js/ and run it through a JS beautifier. Search for strings like /api/ to find every backend route.

Hint 3 — near solution

Grab the bundle with curl or your browser's DevTools, prettify it (e.g. with js-beautify or an online tool), then grep for '/api/' to enumerate routes including deck export and restore endpoints.

Your attempt

Spotted something to improve?

Polish the wording, sharpen a hint, add missing context, fix a payload — your version stays separate from the original and other learners can choose it.

⚠ Report this lab

Enjoying Hintru? Buy me a coffee ☕ ☕