A pack of isolated SSRF mini-labs for CWAP Module 06. Naked labs give you one sink and one primitive - drill it. Methodology labs give you a realistic surface and no answers - you have to search, confirm reachability, and build a method. Track what you have proven on Progress.
127.0.0.1:8099 and ONE in-lab out-of-band collector (oob.m06.lab). The internal service is NOT reachable directly and is NOT served through the /m06-p/ proxy - the only way to read it is to make one of the sinks fetch it for you.A fetch-by-URL importer with no defence. Point it at the internal loopback admin service and read its config straight out of the response.
The same fetcher reaches the cloud metadata endpoint. Walk the IAM path and read the (fake) instance credentials.
A link-preview that honours the file:// scheme. Read a local file off the server's disk.
A naive string blocklist rejects the literal spellings localhost / 127.0.0.1. The same loopback host written another way sails past it.
A fire-and-forget webhook sink that returns NO response body. Confirm it fires out-of-band, then develop a method to find and read the internal admin service through it.