Query strings and endpoints

Passing input in the URL

Everything after the ? in a URL is the query string: name=value pairs joined by &. The target's landing page linked to /api/ping, which takes a host parameter:

curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1'

In the terminal

student@vulntech:~$ curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1'
ping: socktype: SOCK_RAW
ping: socket: Operation not permitted
ping: => missing cap_net_raw+p capability or setuid?

Tip: Always wrap a URL that contains ?, &, ; or spaces in single quotes, or the shell will try to interpret those characters before curl ever sees them.

That endpoint takes a value you supply and does something with it on the server. Any time you see that — user input reaching the server — your pentester instinct should wake up. We'll come back to this exact endpoint in module 3.

You can save any response to a file with -o, then search it offline:

curl -s http://127.0.0.1:8080/ -o landing.html
grep -o '/api/[a-z]*' landing.html

In the terminal

student@vulntech:~$ curl -s http://127.0.0.1:8080/ -o landing.html
student@vulntech:~$ grep -o '/api/[a-z]*' landing.html
/api/ping
/api/ping