Elkashawi
pentestinghere/elkashawi
Published
31 Aug 2026
Published on elkashawi.github.io
Sign in to open the link
Two endpoints, POST /get-secret1 and POST /get-secret3, on a target I’ll refer to as [REDACTED], took a JSON body with a field called gatewayHost. That field was meant to point at some internal secrets-retrieval service, but there was no validation on it at all. Whatever URL I put in there, the server would go fetch it, and then it would helpfully paste the raw response of that fetch directly into its own error message.
No cookies, no auth headers, nothing. Just a raw POST request.
That combination, unauthenticated SSRF plus the server echoing back whatever it fetched, turns a “the server makes outbound requests” bug into a full read primitive against anything that server can reach.