---
title: "Discussion on \"TryHackMe — Rabbit Store (Medium) Walkthrough: Mass Assignment → SSRF → SSTI → RabbitMQ → Root\" | Hashnode"
description: "Discussion on \"TryHackMe — Rabbit Store (Medium) Walkthrough: Mass Assignment → SSRF → SSTI → RabbitMQ → Root\". Room: Rabbit Store · Difficulty: Medium · Category: Web / Red Team\nTL;DR: A subscription mass-assignment bug unlocks an SSRF endpoint, which exposes an internal API doc revealing a Jinja2 SSTI endpoin"
url: "https://hashnode.com/posts/tryhackme-rabbit-store-medium-walkthrough-mass-assignment-ssrf-ssti-rabbitmq-root/6a48af90f3ddf6a3c6ef7236"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [TryHackMe — Rabbit Store (Medium) Walkthrough: Mass Assignment → SSRF → SSTI → RabbitMQ → Root](https://anhbii.hashnode.dev/tryhackme-rabbit-store-medium-walkthrough-mass-assignment-ssrf-ssti-rabbitmq-root?utm_source=hashnode&utm_medium=feed)

Room: Rabbit Store · Difficulty: Medium · Category: Web / Red Team TL;DR: A subscription mass-assignment bug unlocks an SSRF endpoint, which exposes an internal API doc revealing a Jinja2 SSTI endpoin

Jul 4 · 6 min read · anhbii.hashnode.dev  
Read the article

## Written by

[Hồ Quang Anh](https://hashnode.com/@hoquanganh09)

@hoquanganh09

  
[View profile](https://hashnode.com/@hoquanganh09)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.