{"id":1406,"date":"2026-08-31T16:32:22","date_gmt":"2026-08-31T16:32:22","guid":{"rendered":"https:\/\/www.securesteps.tn\/?p=1406"},"modified":"2026-08-31T16:32:22","modified_gmt":"2026-08-31T16:32:22","slug":"just-health-walkthrough","status":"publish","type":"post","link":"https:\/\/www.securesteps.tn\/ar\/just-health-walkthrough\/","title":{"rendered":"Just Health Walkthrough \u2014 Exfiltrating \/flag Through a 31-Hop Redirect Chain"},"content":{"rendered":"

Just Health Walkthrough \u2014 Exfiltrating \/flag Through a 31-Hop Redirect Chain<\/h1>\n

Platform:<\/strong> CyberTalents \u00b7 Category:<\/strong> Web \u00b7 Difficulty:<\/strong> Medium\/Hard
Goal:<\/strong> Read \/flag<\/code>, which only responds to requests from 127.0.0.1<\/code>.<\/p>\n

\n

Challenge<\/h2>\n

“Just Health” is a Flask health-check application. You create checks (HTTP, ping, DNS…) and it probes them on a schedule. The source is provided (Dockerfile<\/code>, app\/<\/code>).<\/p>\n

The flag lives at \/flag<\/code> \u2014 but only for localhost:<\/p>\n

@auth_bp.route(\"\/flag\")\ndef flag():\n    if request.remote_addr != \"127.0.0.1\":\n        abort(403)\n    with open(\"\/flag.txt\") as f:\n        return f.read(), 200, ...\n<\/code><\/pre>\n
We’re not localhost. But the app does<\/em> make outbound requests on our behalf \u2014 an SSRF primitive.<\/p>\n
The vulnerability: SSRF + response reflection<\/h2>\n
The HTTP health check uses:<\/p>\n
requests.get(url, allow_redirects=True, ...)\n<\/code><\/pre>\n
The URL is fully user-controlled. Normally the response body is not<\/strong> returned \u2014 the result message is just “HTTP 200”.<\/p>\n
But look at the exception handler:<\/p>\n
except requests.exceptions.TooManyRedirects:\n    dest = requests.get(last_location, allow_redirects=False, ...)\n    message = f\"Too many redirects ... final destination {dest.text[:8192]}\"\n<\/code><\/pre>\n
When requests<\/code> raises TooManyRedirects<\/code> (it does so while processing the 31st<\/strong> redirect response), the app fetches the last Location<\/code> header<\/strong> with redirects disabled and reflects up to 8192 bytes of its body into the check result.<\/p>\n
So the plan: build a redirect chain of 31 hops<\/strong> whose 31st response has Location: http:\/\/127.0.0.1:5000\/flag<\/code> (the app listens on port 5000<\/strong> inside the container \u2014 nginx proxies 80 externally). When the chain is followed:<\/p>\n
    \n
  • hop 31 \u2192 TooManyRedirects<\/code> fires<\/li>\n
  • app fetches http:\/\/127.0.0.1:5000\/flag<\/code> directly \u2192 200 + flag body<\/li>\n
  • flag is reflected into the result message we can read<\/li>\n<\/ul>\n
    Building the chain (the hard part)<\/h2>\n
    The check URL is limited to 2048 characters<\/strong> \u2014 a pure httpbin nesting of 31 levels (~7KB) won’t fit. We need URL shorteners that:<\/p>\n
      \n
    • are reachable from the challenge server with python-requests’ default UA (no bot-blocking)<\/li>\n
    • don’t deduplicate or blacklist targets<\/li>\n
    • redirect anywhere \u2014 including 127.0.0.1<\/code><\/li>\n<\/ul>\n
      The hops<\/h3>\n
        \n
      • tinyurl<\/strong> \u2014 accepts http:\/\/127.0.0.1:5000\/flag<\/code> directly, serves 301 to any UA. Perfect final hop.<\/li>\n
      • clck.ru<\/strong> \u2014 each clck link is itself 2 hops<\/strong>: clck.ru\/xxx \u2192 302 \u2192 sba.yandex.ru\/redirect?url=<target> \u2192 302 \u2192 <target><\/code>.<\/li>\n
      • httpbin<\/strong> redirect-to?url=<next><\/code> \u2014 one hop to chain into the next clck link.<\/li>\n<\/ul>\n
        So one clck link whose target is httpbin.org\/redirect-to?url=<next-clck-link><\/code> gives 3 hops<\/strong>: clck \u2192 sba \u2192 httpbin \u2192 next clck<\/code>.<\/p>\n
        The chain<\/h3>\n
        c1 \u2192 sba \u2192 hb(c2) \u2192 c2 \u2192 sba \u2192 hb(c3) \u2192 ... \u2192 c10 \u2192 sba \u2192 hb(T) \u2192 T \u2192 301 \u2192 \/flag\n<\/code><\/pre>\n
        10 clck links \u00d7 3 hops + 1 tinyurl hop = 31 redirects<\/strong>. The 31st response is tinyurl’s 301 with Location: http:\/\/127.0.0.1:5000\/flag<\/code> \u2014 exactly what TooManyRedirects<\/code> needs.<\/p>\n
        Dead ends we hit (worth knowing)<\/h2>\n
          \n
        • cleanuri.com<\/strong> \u2014 404s the python-requests UA (bot protection). Useless.<\/li>\n
        • is.gd \/ v.gd<\/strong> \u2014 blacklist shortener domains and follow<\/em> the chain to reject localhost destinations. Useless.<\/li>\n
        • clck.ru<\/strong> \u2014 dedups by raw target string, and passes clck.ru targets through without creating a new record \u2192 you cannot chain clck\u2192clck directly; you must interleave httpbin.<\/li>\n
        • sba.yandex.ru<\/strong> \u2014 throttles hard after ~10 requests (403). Keep sba hops \u2264 10 \u2014 exactly why the chain uses 10 clck links.<\/li>\n
        • spoo.me<\/strong> \u2014 rejects localhost in targets.<\/li>\n
        • Port<\/strong>: 127.0.0.1:80<\/code> is refused inside the container; the app binds 0.0.0.0:5000<\/code>.<\/li>\n<\/ul>\n
          Exploit flow<\/h2>\n
            \n
          1. Create the tinyurl link to \/flag<\/code>, then build c10 \u2192 c1 backwards (each clck(hb(next))<\/code>).<\/li>\n
          2. Login (any account works), add a new HTTP check whose URL is c1<\/code>.<\/li>\n
          3. Trigger the check run.<\/li>\n
          4. The result message contains the reflected flag.<\/li>\n<\/ol>\n
            Flag{QCFAWHJYdTlNMFpIRWF1QWcxZURpSGgrSjE2bTRCR3dpS3V4dWNBRU9UV1U5ST1iMjg3YjdkZjJiMThhNDgy}\n\nNote (2026-08-31): the flag rotates per instance. Fresh instance yielded a different flag with the same exploit, unchanged.\n<\/code><\/pre>\n
            Why this worked (the real lesson)<\/h2>\n
              \n
            1. SSRF with a side channel.<\/strong> The classic fix for blind SSRF is “you can’t see the response” \u2014 this app broke that by reflecting the final redirect destination’s body in an error path.<\/li>\n
            2. The 31-hop trick.<\/strong> TooManyRedirects<\/code> fires after<\/em> receiving the 31st redirect \u2014 the app then fetches the last Location from the server side, turning our attacker-chosen URL into a server-side request to localhost.<\/li>\n
            3. Shortener ecosystems are unpredictable.<\/strong> The same chain collapses on one service (dedup, bot walls, localhost blacklists) and works on another \u2014 recon of each hop’s behavior was half the solve.<\/li>\n<\/ol>\n
              Defense takeaways:<\/strong><\/p>\n
                \n
              • Block loopback\/private ranges in any URL-fetching feature (SSRF allowlists + DNS rebinding protection).<\/li>\n
              • Don’t follow \u2014 let alone reflect \u2014 arbitrary redirect destinations.<\/li>\n
              • Never expose response bodies of server-side fetches, even in error messages.<\/li>\n<\/ul>\n
                Files<\/h2>\n
                  \n
                • exploit4.py<\/code> \u2014 the working exploit (chain build + check create + run)<\/li>\n
                • test_redirect.py<\/code> \u2014 local simulation of the TooManyRedirects reflection<\/li>\n<\/ul>\n
                  \n
                  Writeup of a solved CyberTalents web challenge. All attack surface described here is part of the challenge’s intended vulnerable application.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"
                  Turning a blind SSRF into a readable flag by abusing TooManyRedirects: a 31-hop chain of clck.ru + httpbin + tinyurl redirects ending at 127.0.0.1 (CyberTalents Web CTF).<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1406","post","type-post","status-publish","format-standard","hentry","category-webapplicationsecurity"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t