← back to room
SSRF
Basic SSRF
Scenario
FetchBot's URL fetch form retrieves any address the server can reach. Internal cloud metadata lives at a link-local address vendors use for instance info. Make the fetcher retrieve that internal resource.
Your approach
- Submit a benign external URL to see normal fetch behaviour.
- Try the cloud metadata IP in the url parameter.
- Read the simulated metadata body returned by the lab.
- Extract the flag embedded in the metadata response.
- Submit the metadata flag.
The fetcher requests whatever URL you give it. Reach the internal metadata service at http://169.254.169.254/.
Sandbox note: all fetches hit a simulated internal network; no real requests leave the server.
Sandbox note: all fetches hit a simulated internal network; no real requests leave the server.