Progress

0 / 11 SSRF findings proven this session. Everything below is reachable only by abusing one of the three fetch sinks (Import / Webhook / Preview). The internal admin service is never exposed directly.

⬜ In-band SSRF: read the internal loopback service (127.0.0.1:8099)

⬜ Cloud metadata SSRF: retrieve the fake IAM credentials (169.254.169.254)

⬜ file:// scheme: read a local file via the fetcher

⬜ Filter bypass: decimal IP encoding reaches blocked loopback

⬜ Filter bypass: octal / hex IP encoding reaches loopback

⬜ Filter bypass: 127.0.0.1 alternate spellings (127.1 / 0.0.0.0 / [::1])

⬜ Allowlist bypass: @ userinfo trick (allowed.example@127.0.0.1)

⬜ Blind SSRF: confirmed out-of-band via the in-lab collector

⬜ Internal port scan: fingerprint the open service port through the sink

⬜ Redirect-based bypass: allowed host 302-redirects to the internal service

⬜ Alternate scheme: dict:// / gopher:// reaches the internal service