SSRF via gopher:// to a non-HTTP service

/gopher · sink: pycurl

Fetcher uses libcurl, which speaks gopher://. A TCP service is listening on 127.0.0.1:6479.


Hint

libcurl supports gopher://. The format is gopher://host:port/_<url-encoded-payload>. Try gopher://127.0.0.1:6479/_PING%0d%0a — whatever you send is forwarded verbatim, and the service replies with a flag.

View source for this lab →