By inspecting the metadata of the generated PDF files (using tools like exiftool or by looking at the PDF's properties), you can identify the backend engine: .
Your server responds with a 302 Redirect to file:///etc/passwd . pdfy htb writeup upd
Input the URL of your hosted redirect script into the PDFy web form (e.g., http://your-server-ip/index.php ). The PDFy server sends a request to your server. By inspecting the metadata of the generated PDF
As noted in the official HTB discussion , beginners often overcomplicate this by trying to get a shell, but the goal is purely a file leak. The PDFy server sends a request to your server
You need a way to serve a 302 Redirect . You can use a simple PHP script or a Python server to achieve this. Use code with caution. Step B: Expose Your Server