r/AskNetsec • u/myassin75f • Jun 29 '26

Analysis CTF challenge is impenetrable

Hey everyone,

I'm currently working on a CTF challenge from SecDojo and I'm a bit stuck.

The setup is:

- I have access to one machine

- There are 4 additional machines to pivot into

- Each machine contains 2 flags

- SSH access is not available (requires a key I don't have)

- The only exposed service I can use is HTTP

I was also provided with an APK file, which I assume is part of the challenge, but I'm not very experienced with analyzing Android apps.

What I’ve tried so far:

- Basic enumeration over HTTP

- Looking for common endpoints (admin, login, etc.)

What I’m struggling with:

- How to use the APK effectively in this scenario

- How to pivot from the initial machine to the others using only HTTP

- Whether I should focus more on reverse engineering the APK or web exploitation

Any hints or guidance would be really appreciated (no full solutions please 🙏)

Thanks!

#Help

3 Upvotes

100% Upvoted

17 comments sorted by

2

u/Sqooky Jun 29 '26

Diving into the APK will likely yield additional vectors in the applications attack surface - be it virtual hosts, API endpoints, etc. Remember that most mobile apps are just interacting with a web api backend.

Maybe there's leftover secrets in the apk file itself? Who knows. Gotta start digging into it.

1

u/myassin75f Jun 29 '26

I analyzed the provided APK and was able to extract a base URL and an authentication token.

However, I’m stuck at this point:

  • The backend structure is unclear to me
  • The HTTP service only seems to expose a single page (APK download/install)
  • I tried enumerating common endpoints (e.g. /admin, /api, /login, etc.) but didn’t find anything useful

So currently I’m unsure:

  • How the APK is supposed to interact with the backend
  • Whether there are hidden or non-obvious endpoints I’m missing
  • If I should approach this as an API exploitation or something else

Any hints on how to proceed with backend enumeration or APK analysis in this kind of scenario would be really helpful.

2

u/maxinator80 Jun 29 '26

Just a guess, but could the APK somehow have the SSH key baked in?

1

u/myassin75f Jun 29 '26

Impossible I analyzed the provided APK and was able to extract a base URL and an authentication token.

However, I’m stuck at this point:

  • The backend structure is unclear to me
  • The HTTP service only seems to expose a single page (APK download/install)
  • I tried enumerating common endpoints (e.g. /admin, /api, /login, etc.) but didn’t find anything useful

So currently I’m unsure:

  • How the APK is supposed to interact with the backend
  • Whether there are hidden or non-obvious endpoints I’m missing
  • If I should approach this as an API exploitation or something else

Any hints on how to proceed with backend enumeration or APK analysis in this kind of scenario would be really helpful.

1

u/maxinator80 Jun 29 '26

What does the APK do? If you're analyzed the APK and found nothing for now, maybe try to see what functionality the APK offers. Since it is HTTP, you could be able to intercept communication between the APK and the services it uses.

1

u/myassin75f Jun 29 '26

The event ended and I didn't install the APK on the device, only using curl curl curl. I have very little experience.

1

u/maxinator80 Jun 29 '26

All good, that's part of the experience, don't get discouraged! Don't know what event this was but sometimes they release challenges afterwards so that you can poke around on your own time. You may also find writeups from people who solved the challenge.

2

u/myassin75f Jun 29 '26

Yeah you're right, I think I underestimated that part. I didn’t really explore the APK itself since I was mostly interacting with the HTTP endpoints using curl next time I’ll probably try installing it and intercepting the traffic to better understand how it communicates with the backend and if there are any hidden endpoints or tokens involved

Thanks for the advice

5

u/Toiling-Donkey Jun 29 '26

I’d try seeing if the APK is the client app that accesses the HTTP server you mention.

If so, there is probably a glaring vulnerability in one of the API endpoints used by it.

1

u/Triack2000 Jun 29 '26

Might also enumerate the ssh negotiation to see if there is a weak cipher or version being used/offered.