← back to room
SSRF
SSRF to PDF
Scenario
FetchBot can render any URL into a downloadable PDF report. The PDF engine follows redirects and loads remote content like a headless browser. Generate a PDF that includes secrets from the cloud metadata service.
Your approach
- Open the PDF render lab and supply the metadata URL.
- Download or preview the generated PDF.
- Search the document text for the internal flag.
- Submit the metadata flag extracted from the PDF.
The URL is rendered to a downloadable PDF. Point it at http://169.254.169.254/ and open the PDF to read the metadata.
Sandbox note: all fetches hit a simulated internal network; no real requests leave the server.
Sandbox note: all fetches hit a simulated internal network; no real requests leave the server.