MD2PDF TryHackMe — Writeup Introduction MD2PDF is a TryHackMe web challenge that demonstrates how a seemingly harmless Markdown-to-PDF feature can introduce serious security flaws when server-side …

InfoSecWriteUps' platform is  dedicated to providing insights and resources for cybersecurity professionals and enthusiasts. Through articles, tutorials, and security research, InfoSecWriteUps offers insights into cybersecurity vulnerabilities, attack techniques, and defense strategies. Readers can learn about penetration testing, threat intelligence, and incident response to enhance their cybersecurity knowledge and skills.

InfoSec Write-ups

A walkthrough of exploiting a Markdown-to-PDF conversion vulnerability on TryHackMe's MD2PDF challenge. The attack leverages HTML iframe injection within Markdown input to bypass localhost-only access controls, demonstrating how server-side rendering can expose internal endpoints. The writeup covers reconnaissance with nmap, directory enumeration with dirsearch, and exploiting the parser's HTML support to retrieve restricted content through SSRF.

MD2PDF TryHackMe — Writeup. Exploiting Markdown to PDF Conversion

Get Death Esther’s stories in your inbox

Exploitation via Localhost Restriction Bypass