← back to room
SSRF
SSRF via Screenshot
Scenario
A screenshot service renders whatever URL you supply server-side. Internal admin panels listen on localhost ports not exposed publicly. Capture a screenshot that proves the renderer reached an internal target.
Your approach
- Open the screenshot lab and note the url input field.
- Point it at internal metadata or a localhost service port.
- Generate the screenshot and inspect the result preview.
- Find the flag in the rendered image or accompanying message.
- Submit the SSRF flag.
The screenshot service renders any URL server-side. Point it at http://169.254.169.254/ or http://localhost:8080/ and read what it captured.
Sandbox note: all fetches hit a simulated internal network; no real requests leave the server.
Sandbox note: all fetches hit a simulated internal network; no real requests leave the server.