Naked - Basic SSRF

Import an asset by URL

No host filtering at all - the server fetches whatever URL you hand it and returns the body. There is an internal admin service on loopback port 8099 that this proxy never exposes. Make the importer fetch it and read its config in-band.

← back to the practice pack index