Search for a command to run...
A bug bounty story by GRuMPz.
| Vulnerability Operations @ Synack | Bug Bounty Hunter. Security Researcher. Wannabe hacker, sharing my thoughts on how to be successful in the cyber security space, after pivoting careers of being a decade long Sales Director.
No comments yet. Be the first to comment.
This is a series of my personal security research, hunting for 0days, and other vulnerabilities focused on web applications.
Inspiring new bug bounty hunters with a simple RCE vulnerability discovery.
Discovered by: Michael KimVendor: ui-lib (Uilibrary)Product: Stocky – POS with Inventory Management & HRM (“Ultimate Inventory Management System with POS”)Affected Version: 5.0 (as released June 2025)Impact: Arbitrary JavaScript Execution (Stored XSS...
Discovered by: Michael Kim & Sergio MedeirosVendor: iNiLabsProduct: School Express – School Management System (SMS Express)Affected Version: 6.2 (other versions not tested)Impact: Arbitrary JavaScript Execution (Stored XSS)Attack Type: Remote (Authen...
Discovered by: Michael Kim & Sergio MedeirosVendor: LiquidThemesProduct: MagicAI (a.k.a. MagicProject AI)Affected version: 9.1 (other versions untested)Impact: Arbitrary JavaScript execution in users’ browsers (stored XSS)Attack type: Authenticated r...
Introduction: As a seasoned cybersecurity researcher and penetration tester, I am constantly on the lookout for certifications that sharpen my skills and keep me at the forefront of web application se
The Power of Simplicity: A Bug Bounty Tale with Big Results
While enumerating the scope of a target on a private bug bounty program, I came across a subdomain used for generating PDF files. However, it seemed out-of-scope as they were simply white labeling a service called PDFMyURL, which lets you convert any URL or web page into a PDF.
I couldn't resist exploring the functionality to understand how their service operates. It's quite straightforward. By sending a simple POST request with a URL parameter and the relevant URL, the backend application will change the user-provided URL into a downloadable PDF file.
Given that the web application sends requests to a specific location to generate a PDF file, I started testing the application to check for Server-side Request Forgery (SSRF) vulnerabilities. SSRF is a flaw that enables an attacker to make the server-side application send requests to unintended places. This could lead the server to connect to internal services that are meant to be accessed only within the organization's infrastructure.
After testing the application for Server-side Request Forgery (SSRF) vulnerabilities, I found that the security measures in place effectively blocked SSRF attacks. I attempted common bypass techniques using decimal and octal formats but was unsuccessful in my attempts.
I then tried using various IP variations within the 127.0.0.0/8 CIDR range for localhost. In particular, I entered the URL http://127.127.127.127 into the PDF generator. This allowed me to successfully bypass the security measures in place, enabling us to generate the PDF.
As seen in the response section of BurpSuite in the screenshot above, our PDF was successfully generated. The title indicates (Apache2 Ubuntu Default Page: It works!), confirming our ability to access the localhost of the underlying host. The application handled our localhost payload and displayed the output in the PDF file.
And there we have it. We successfully created a simple yet effective payload that bypassed the SSRF security controls in place. This allowed us to exploit a full read SSRF by using the localhost CIDR range. It's a valuable lesson for beginners in bug bounty hunting: having a solid testing approach, working through challenges, and persisting until you reach your desired outcomes.
Further investigation revealed a widespread issue affecting numerous customers and thousands of users, leading to a pending CVE.
Remember, fellow hackers, keep exploring the digital realm, and hacking the planet.