Navigating to the website, we find a simple web application that takes a URL and converts the webpage into a PDF document. This is a massive "low-hanging fruit" indicator for SSRF. Whenever an application fetches content from a remote URL you provide, you should immediately test if it can fetch internal resources. 2. Identifying the Vulnerability (SSRF)
Download the generated PDF, and you will see the contents of the /etc/passwd file. Looking through the users, you should notice a user named . 4. Pivoting to the User Flag
Since the server fetches and renders the URL, you can use the file:// protocol to point it toward internal system files.
Next, we perform a system enumeration using tools like linpeas and systemd-analyze . The results reveal that the machine uses a SystemD service called pdfy-converter to manage the PDF converter service on port 8080.