Aster Check
Aster Check is a vendor-risk compliance platform with a signed-URL document gateway, an internal ops console, and a self-hosted code repository.
The Scenario
AsterCheck is a vendor-risk and compliance SaaS used by security teams to track third-party attestations and automate periodic re-checks.
After a contentious incident review, the company suspects their customer-facing portal is exposing more than it should and that internal tooling may be reachable in ways it wasn't designed for. You've been brought in as an external operator to validate the real-world impact, document what an attacker could obtain, and provide evidence the team can act on--without disrupting production workloads.
Lab Intel
Synopsis
AsterCheck have enlisted your services to validate the security posture of their vendor-risk compliance platform. Following a contentious incident review, leadership suspects the customer-facing portal is exposing more than intended and that internal tooling may be reachable through unintended pathways.
Architecture
A master-difficulty multi-service lab featuring five interconnected containers: an nginx gateway, a customer-facing app, a signed-URL fetcher, an internal reports console, and a self-hosted code repository. The challenge demands chaining six distinct vulnerability classes across service boundaries, making it one of the most complex labs on the platform.
Who It's For
Designed for advanced penetration testers and CTF veterans who are confident chaining multi-step exploits across microservice architectures. You should have prior experience with SSRF, SQL injection, and server-side template injection, and be comfortable with subdomain enumeration and source code analysis.
Skills You'll Practice
- Subdomain enumeration and DNS reconnaissance techniques
- SSRF exploitation and internal network pivoting
- SQL injection fundamentals including filter bypass techniques
- Server-side template injection (SSTI) concepts
- Git repository analysis and commit history inspection
- HMAC and cryptographic signing concepts
What You'll Gain
- HMAC signing oracle abuse
- SSRF through signed-URL fetchers
- Git history secret extraction
- Case-sensitive SQL injection blacklist bypass
- Jinja2 SSTI for environment variable exfiltration
- Cross-service attack chaining in microservice architectures