🧪 Labs › Request Forgery
Server-Side Request Forgery (SSRF)
Severity: High
Make the server fetch a URL of your choosing — including ones you can't reach.
What it is
SSRF is making the server send a request on your behalf. If a feature fetches a URL you supply (a webhook, a URL preview, an image importer), you may be able to point it at internal systems the server can reach but you can't.
Cloud metadata endpoints, internal admin panels, and databases bound to localhost all become reachable from the vulnerable server's position in the network.
Impact ranges from internal recon to reading cloud credentials to full internal compromise.
How to approach it
- Find a feature that takes a URL (or a hostname, or anything that becomes one) and fetches it.
- Point it at something only the server can reach and compare the response to a known-bad and known-good target.
- When the response isn't shown back, use timing or an out-of-band listener to confirm the request happened.
- Explore what internal surface the server's vantage point exposes.
Your task
Use the URL-fetching feature to reach an internal service that is not exposed to you directly.
▶ Access the labOpens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.
How to prevent it
- Allowlist the exact destinations a feature may fetch; deny by default.
- Block requests to internal ranges and metadata addresses at the network layer.
- Don't reflect raw fetch responses back to the user.