SSRF Lab: Beat the URL Allowlist With a Redirect

PreviewBot only accepts URLs on an allowlist — example.com, wikipedia.org, a couple of others. That feels safe. But it checks the URL you submit, then follows whatever redirects that URL returns, without checking again. Point an allowed host at a redirect, and the fetcher walks straight to the internal network. Lab at a glance: Advanced · 110 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind…

Read full article →