Hintru Propina ENES ← Todos los labs

Tanuki: Flashcard Backup Restore

EN medium CTF challenge XXEXML External Entityin-band exfiltrationJS bundle reconAPI enumerationDTD injectionarbitrary file read
Original

Tanuki is a flashcard web app with an XML-based deck export and a JSON-driven restore endpoint. The server secretly round-trips your JSON through an XML template with DTD processing enabled — giving you a path to read arbitrary files off the server without any out-of-band channel. Your goal is to exfiltrate the flag at /app/flag.txt entirely in-band.

0/7
resueltos
Paso 1 Paso 2 Paso 3 Paso 4 Paso 5 Paso 6 Paso 7
recon

Paso 1 · Map the API from the client bundle

Objetivo: Discover all API endpoints by extracting and reading the minified React JavaScript bundle served by the application.

Contexto: The app is a React SPA. All client-side API calls are baked into the JavaScript bundle at /static/js/main.*.js. Prettifying and searching the bundle is the fastest way to enumerate every endpoint before touching the app.

Pistas progresivas

Revela solo las que necesites. Claude lleva la cuenta de cuántas usaste para calibrar la retroalimentación.

Pista 1 — empujón direccional

The frontend is a compiled React SPA. Where would all the API endpoint strings live?

Pista 2 — técnica / clase de vuln

Fetch the JS bundle from /static/js/ and run it through a JS beautifier. Search for strings like /api/ to find every backend route.

Pista 3 — casi la solución

Grab the bundle with curl or your browser's DevTools, prettify it (e.g. with js-beautify or an online tool), then grep for '/api/' to enumerate routes including deck export and restore endpoints.

Tu intento

¿Encontraste algo para mejorar?

Puliendo la redacción, afinando una pista, agregando contexto que falta, corrigiendo un payload — tu versión queda separada de la original y otros aprendices pueden elegirla.

⚠ Reportar este lab

¿Te gusta Hintru? Buy me a coffee ☕ ☕