[Z10N]

Hello everyone,
I am writing this post to alert the community to a serious vulnerability I discovered in DarkForums.ST that could compromise the privacy and security of all visitors.

---

Exploit Summary:
Type: SSRF (Server-Side Request Forgery)
Vector: Image Upload / Rendering
Impact: Attacker can log IP addresses and timestamps of forum visitors via a crafted external image.

---

How It Works:
Through a maliciously crafted image embedded in forum content, an attacker can trigger server-side HTTP requests to external resources they control. When other users load a thread or post containing this image:

• The server attempts to fetch the image or preview it.
  
• This request is sent to an external attacker-controlled domain.
  
• The attacker receives the request, logging the real IP address and timestamp of the viewer.
  

This is possible due to improper validation and sanitization of image URLs in the rendering pipeline.

---

Real-World Impact:

• Every forum visitor who views the malicious post unknowingly leaks their IP address.
  
• This includes moderators, administrators, and even hidden users.
  
• Attackers can correlate activity, perform targeted attacks, or deanonymize users.
  

[mikasaa]

who even uses dark forums now

This forum account is currently banned. Ban Length: (21h, 1m remaining)
Ban Reason: NSFW leaks is not allowed here

[Kingdom]

Avoid using forums where the administrators or moderators do not ensure their own safety.

[KingDice]

dude
well done

[postmanpat]

It's not an SSRF vulnerability; what you're describing is an XSS

[Z10N]

It's not an SSRF vulnerability; what you're describing is an XSS

Really?

[Wieko]

Admin can't even implement proper validation

[62581]

niggers cant even understand what a ssrf is

[Z10N]

niggers cant even understand what a ssrf is

What you want to say clearly?

[Datah8ter]

Wouldn't even doubt it that forum was a honeypot