Basic SSRF

/basic · sink: requests.get

Unfiltered server-side URL fetch.


Hint

There's a service the public can't reach: http://127.0.0.1:8089/. Try /admin or /secret on it.

View source for this lab →