← back to room
SSRF
SSRF IP Blocklist Bypass
Scenario
Localhost hostnames and literal internal IPs are blocked in the status checker. Only the up-or-down result is returned—no response body. Reach an internal service using an alternate encoding of the address.
Your approach
- Confirm blocked hosts return an error or denial message.
- Try decimal, octal, or IPv6-mapped forms of loopback.
- Hit an internal port such as 8080 with the encoded address.
- Verify the checker reports the site as up.
- Submit the task flag for a successful bypass.
Localhost and internal IPs are blocklisted by name. Bypass with an alternate encoding, e.g. decimal http://2130706433:8080/ (up/down only).
Sandbox note: all fetches hit a simulated internal network; no real requests leave the server.
Sandbox note: all fetches hit a simulated internal network; no real requests leave the server.