It works! So we at least know we can make the server render files from a server that I control. Next, I tried to load two different image endpoints to see if I could load any image and also determine if they were whitelisting domains.įirst up, my go-to remote image (Google logo): We can also guess that they may have implemented some form of URL/file validation to prevent file inclusion or rendering dangerous URLs. It makes sense, right? The file's name is 'media_preview', so we can make an assumption this was built specifically for rendering only images. Looking through the Google search results again, I realized that all the results were for images. I tried a typical attack of supplying my own server and checked my access logs to see if they loaded it. That means there is a good chance they are taking user input (url param), loading the response content, and rendering it back to the user. It looks like an endpoint for loading external images and displaying it back to the client. There was one endpoint that caught my eye: As an example, go to and search for this: site: ext:php The first thing I did with ESEA was perform initial recon by Google dorking my way through all the endpoints on their website. Using a cool trick that Ben Sadeghipour showed me, I was able to pull private information from ESEA's AWS metadata. The most interesting discovery was a Server-Side Request Forgery vulnerability. I spent a night taking a look over the website and found a few vulnerabilities.

They just recently launched a bounty program that puts their website, game client, and game servers in scope for security research. For anyone familiar with the Counter-Strike competitive scene, you know about ESEA.

Playnow esea