← back to room
SSRF
SSRF Blocklist Bypass with Response
Scenario
The same blocklist guards a fetcher that returns full response bodies. Alternate IP encodings still apply, but this time you can read page content. Pull the flag from an internal admin panel on loopback.
Your approach
- Reuse blocklist bypass encodings from the status-only lab.
- Request localhost port 8080 with the encoded IP form.
- Read the HTML or JSON body in the fetch result.
- Extract the internal metadata or panel flag.
- Submit the SSRF flag.
Same blocklist as before, but the response body is returned. Bypass with http://2130706433:8080/ to read the internal admin panel.
Sandbox note: all fetches hit a simulated internal network; no real requests leave the server.
Sandbox note: all fetches hit a simulated internal network; no real requests leave the server.