1. Web Security Academy
  2. SSRF
  3. Lab

Lab: SSRF with blacklist-based input filter

This lab has a stock check feature which fetches data from an internal system.

To solve the lab, change the stock check URL to access the admin interface at http://localhost/admin and delete the user carlos.

The developer has deployed two weak anti-SSRF defenses that you will need to bypass.

Want to track your progress and have a more personalized learning experience? (It's free!)

Sign up Login