How I hacked a stranger
Before you continue
Unauthorized and illegitimate access to virtual infrastructure is a serious crime depending on the activity that has been carried out with said intrusion. Whenever you are going to carry out a practice such as the one demonstrated below, you must be careful to act ethically and in a good way. Do not allow the good knowledge you have gained to be misused.
- Operating system: Debian 13
Note: This was all done with the authorization of the target. While performing the pentest I've made sure to always ensure the safety of the target and it's information, as you should too.
Welcome, my fellow hackers! I recently came across a page of a user on Discord, a moderator of a server, that caught my attention. Since we are curious here, I started to investigate and found quite interesting things. In this post, I explain the steps I followed, the tools I used, and how I exploited the vulnerability to achieve the desired goal. But before that, let's start by talking about what Cloudflare is.
Cloudflare, the "ultimate" security measure
Cloudflare is a WAF (Web Application Firewall), which is a security measure that is implemented on websites in order to protect against web attacks such as "XSS", "SQLi" or "IDORs". Cloudflare changes the IP address of the website (to which the requests are sent) to an IP of one of Cloudflare's servers, Cloudflare analyzes the web request that is sent to the server before reaching it, and if it detects any anomaly or malicious request, it prevents access to the server with Cloudflare installed, and prohibits access to the website due to malicious activity. On the other hand, if it detects that the web request is normal and does not contain information that is usually related to cyberattacks, it allows it to pass through to the web server.
Cloudflare protects against any web attacks that are related to web requests, or even DDOS attacks. That is why many consider it a fundamental part of cybersecurity and because it is such an effective measure, they install it to protect their system. The problem is, Cloudflare only protects against web attacks when it is an intermediary between client-server communication. For this reason, if the attacker decides not to make a request to Cloudflare to be redirected to the server, but makes that same request directly to the server, it does not pass Cloudflare's analysis and the malicious request reaches the server. It doesn't stop there even so. since there are Cloudflare servers that act as intermediaries, the attacker will never know which server the website corresponds to, or at least, it shouldn't be.
Checking the website
The main target was the main website of a person named "Davito". It was a kind of portfolio, which he uses to make himself known. I analyzed the portfolio website in its entirety and did not find anything interesting (at least, as far as vulnerabilities are concerned).
However, when reviewing the technologies that the web used, I found two things. The first was that, when reviewing the javascript files on the website, I found an API key belonging to their Spotify account, with which they could take possession of it (that's why it shouldn't be visible publicly).
Also, using "Wappalizer", I also discovered that their website was behind a "Cloudflare" tunnel.
Which led me to think that maybe I could get the IP address of the real server if I checked for data breaches in search engines like "Shodan" or "Censys", so I did the same thing. A quick search of Censys revealed that the domain name was associated with an IP that did not belong to Cloudflare's tunnels.
An IP address in a Cloudflare tunnel looks like this:
Both addresses serve to reach the end server. However, those IPs are not the actual IPs of the "davito.es" web server. That's why with Censys I found out that there was an IP associated with the "davito.es" website that wasn't within Cloudflare's IP range:
Looking at this IP better, we can see different ports that it has open. This is because hostings usually do not open more ports than necessary. However, the fact that the page is Spanish, but that the server is located in France, and I have open ports that belong to other types of web applications such as monitoring panels, made me think that it was a VPS (virtual private server), and indeed, I was right.
A VPS is a server that anyone can buy to be able to host their own websites or applications on it. Want a Minecraft server but the servers are too expensive? You buy a VPS for 3 euros a month and you make the arrangement. However, Davito has his VPS for purposes other than gaming. On ports 80 (HTTP) and 443 (HTTPS) it had its website hosted, but as you can see below, there are many more open ports.
Exploring the server
Port 22 refers to ssh, a service that allows you to remotely connect to your server so you can manage it. On port 3000 is an installation panel for the "AdGuard Home" software. Apparently the version of the software that can be installed (v0.107.78) has an associated vulnerability called CVE-2022-32175, but due to the context of the attack, we cannot take advantage of this vulnerability.
On port 3001 it has a VPS monitoring panel, to see the resources it consumes, although unfortunately it requires a user login and password, so I didn't bother much in this part.
In port 8085 there is apparently nothing. And if there is, it does not respond no matter how many packages it sends. On port 8090 he apparently has a portfolio of a discord bot that he is either developing, or has developed, and although it looks good, in that port I have not found anything that could indicate that there is any vulnerability.
On port 8096 he has Jellyfin, which is an app that lets you watch your own shows and movies, similar to Netflix, but they're movies you can download. Again, I didn't find any vulnerabilities here.
Interesting vulnerabilities
However, on the next port, 8191, I found something more than interesting. Apparently it was an API of a software called "FlareSolverr", which is a proxy to redirect requests and solve anti-bot challenges such as those of Cloudflare, that is, to allow the passage of protected web pages to bots. Coincidentally, when we access the port we find this:
Apparently, searching Google we can see that there is a vulnerability affecting this version of FlareSolverr, which allows arbitrary reading of files on the affected system. This means that it is possible to read files from the server, whether they are configuration files, hidden web pages, or essential system files such as the /etc/passwd (file that logs system users). This vulnerability is known as "CVE-2026-51031".
To exploit this vulnerability, I have documented myself using the website of "xinyi" (who I believe was the one who first discovered this vulnerability) and I have developed an exploit for it (which can be found on my Github).
daemoncibsec
By exploiting this vulnerability using the exploit I created (although it is also possible to perform the attack using the POC on xinyi's page), I managed to gain access to the system, and if I had wanted to, I probably could have read configuration files, which could contain credentials, files such as ".htaccess" or similar.
However, I stopped investigating once I discovered the vulnerability because I don't want to enter the problem. I continued researching and found on port 8444 a browser called "SearXNG". It is a search metabrowser that receives your query and collects sources from different indexers (i.e. it combines the results you would find on Google, Bing, Brave...) and then shows you the most optimal results on the screen. I checked your browser settings, but found nothing but 2 cookies that weren't really useful to me.
Finally, port 8501 allowed me to access a page that, depending on its context, should be private. This is a "Personal Command Center" for your VPS, where you have some statistics about your VPS.
The curious thing is that the functionalities that deal with critical information, such as the "Dabot database" (which we saw previously was a Discord server and apparently the DB can be accessed from this website), "Status of services" or the "Security and analytics" section, do not have data, not because they do not indicate that they are active, but by errors in the code of the backend of the website.
Thanks to the fact that there are errors in the website's code and this data cannot be obtained, the VPS information is still safe, but as soon as the page is updated with new features and solutions to existing bugs, information that should not be exposed will be publicly exposed. That is why access to this website should be limited only at the local level. And finally, port 9696 did not allow connections, so I have not been able to access and see what potential vulnerabilities could exist in it.
Conclusion
From time to time we can leave positions exposed to the internet that could allow some attackers with malicious intent to damage our work and effort. That is why there are tools such as those seen above (Censys or Shodan) that can help us identify information leaks, and databases of vulnerabilities on the internet that allow us to detect security flaws. I hope this post has helped someone better understand how to identify weak spots in servers and actually exploit them. As always, happy hacking. See you!
