SSRF Playground
A "fetch this URL for me" feature with no allowlist. Point it at internal-looking addresses and see what it leaks.
Server-Side Request Forgery turns a "fetch this URL for me" feature into a way to reach things the server can see and you cannot — internal services, admin panels, and in cloud environments the metadata endpoint holding credentials.
How to use it
- Point the fetcher at an ordinary external URL.
- Redirect it at internal-looking addresses.
- Reach a service that assumed only the internal network could talk to it.
What to take away
The server's network position is the prize
You are borrowing its access. Internal services that skipped authentication because "only our network can reach them" are the usual casualties.
Cloud metadata is the classic escalation
The link-local metadata address hands out temporary credentials to whatever asks from the instance. SSRF plus metadata has caused major real-world breaches.
Blocklists lose
Redirects, DNS records pointing at private addresses, alternative IP encodings and IPv6 all bypass "block 127.0.0.1" thinking. Allowlist destinations instead.
Frequently asked questions
What makes SSRF dangerous when it returns nothing?
Blind SSRF still reaches internal services and can trigger state changes. Timing and error differences leak whether a host or port exists, which is enough to map an internal network.
How is SSRF prevented?
Allowlist the destinations the feature legitimately needs, resolve and validate the address after DNS, block redirects to private ranges, and require authentication on internal services regardless.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- XXE Playground — An XML upload feature that expands external entities. Smuggle a local file read through a "harmless" XML document.
- Path Traversal Playground — A fake "view file" feature that trusts the filename you give it. Climb out of the intended folder with ../ and read files you shouldn't.
- Cloud IAM Misconfig Playground — A role holds one deceptively small permission. Chain it into full account takeover through iam:PassRole.
- Subnet Calculator — IPv4 CIDR → network, broadcast, host range, mask, and host count.