Apprentice
← all rooms
SSRF Expert

Server-Side Request Forgery

Make the server request internal resources. All fetches are simulated.

Mission briefing

FetchBot is an internal utility suite: URL fetchers, screenshotters, and PDF renderers. Each feature asks the server to retrieve a user-supplied address. Discover whether you can make it talk to services that were never meant to be public.

0 / 7 tasks 0 / 95 pts

Objectives

  • Reach the cloud metadata service
  • Bypass allowlists and blocklists
  • Abuse screenshot/PDF renderers
Task 1 Basic SSRF Low 10 pts

Scenario

FetchBot's URL fetch form retrieves any address the server can reach. Internal cloud metadata lives at a link-local address vendors use for instance info. Make the fetcher retrieve that internal resource.

Your approach

  1. Submit a benign external URL to see normal fetch behaviour.
  2. Try the cloud metadata IP in the url parameter.
  3. Read the simulated metadata body returned by the lab.
  4. Extract the flag embedded in the metadata response.
  5. Submit the metadata flag.

Fetch anything — aim for the metadata IP.

Open lab →
Hint

http://169.254.169.254/

Task 2 Screenshot SSRF Medium 10 pts

Scenario

A screenshot service renders whatever URL you supply server-side. Internal admin panels listen on localhost ports not exposed publicly. Capture a screenshot that proves the renderer reached an internal target.

Your approach

  1. Open the screenshot lab and note the url input field.
  2. Point it at internal metadata or a localhost service port.
  3. Generate the screenshot and inspect the result preview.
  4. Find the flag in the rendered image or accompanying message.
  5. Submit the SSRF flag.

The screenshotter renders a URL server-side.

Open lab →
Hint

Same internal targets as task 1.

Task 3 Port Scanning Medium 10 pts

Scenario

FetchBot's health checker reports how long each target took to respond. Open ports answer quickly; closed ones time out. Discover which common database port appears open on localhost.

Your approach

  1. Submit several localhost URLs with different port numbers.
  2. Compare response times or status messages between ports.
  3. Identify the port that behaves like an open service.
  4. Submit only the port number as your answer.

Timing reveals which ports look open.

Open lab →
Hint

Try 127.0.0.1:6379 vs 127.0.0.1:9999

Task 4 Domain Allowlist Bypass Hard 15 pts

Scenario

Policy now requires every URL to contain the corporate domain name. The validator searches the full string rather than parsing authority components. Still reach the internal metadata host while satisfying the substring rule.

Your approach

  1. Observe rejection when the url lacks the trusted domain text.
  2. Craft URLs where the domain string appears but another host is contacted.
  3. Fetch internal metadata through the allowed-looking URL.
  4. Copy the flag from the successful response.
  5. Submit the SSRF flag.

Only URLs containing hackerz-labs.test are allowed.

Open lab →
Hint

http://hackerz-labs.test@169.254.169.254/

Task 5 IP Blocklist Bypass (status) Hard 15 pts

Scenario

Localhost hostnames and literal internal IPs are blocked in the status checker. Only the up-or-down result is returned—no response body. Reach an internal service using an alternate encoding of the address.

Your approach

  1. Confirm blocked hosts return an error or denial message.
  2. Try decimal, octal, or IPv6-mapped forms of loopback.
  3. Hit an internal port such as 8080 with the encoded address.
  4. Verify the checker reports the site as up.
  5. Submit the task flag for a successful bypass.

Localhost names are blocked. Use an alternate encoding.

Open lab →
Hint

Decimal IP: http://2130706433:8080/

Task 6 IP Blocklist Bypass (body) Hard 15 pts

Scenario

The same blocklist guards a fetcher that returns full response bodies. Alternate IP encodings still apply, but this time you can read page content. Pull the flag from an internal admin panel on loopback.

Your approach

  1. Reuse blocklist bypass encodings from the status-only lab.
  2. Request localhost port 8080 with the encoded IP form.
  3. Read the HTML or JSON body in the fetch result.
  4. Extract the internal metadata or panel flag.
  5. Submit the SSRF flag.

Same blocklist, but the response body is returned.

Open lab →
Hint

http://2130706433:8080/

Task 7 SSRF to PDF Expert 20 pts

Scenario

FetchBot can render any URL into a downloadable PDF report. The PDF engine follows redirects and loads remote content like a headless browser. Generate a PDF that includes secrets from the cloud metadata service.

Your approach

  1. Open the PDF render lab and supply the metadata URL.
  2. Download or preview the generated PDF.
  3. Search the document text for the internal flag.
  4. Submit the metadata flag extracted from the PDF.

Render a URL to a downloadable PDF.

Open lab →
Hint

Render http://169.254.169.254/