Beta

This catalog is a work in progress — I'm actively polishing it and adding new labs.

0xBugLabs
← All labs
MediumSSRF

LinkPreview — pivoting into the internal network

A link-unfurling feature — paste a URL, get a snippet back, the same category of feature that generates most real-world SSRF reports. Behind it sits a small internal network you were never given direct access to.

Node.jsExpressDocker Compose (2 services)

Run it locally

git clone https://github.com/G3kSec/0xBugLabs.git
cd 0xBugLabs/labs/ssrf/linkpreview-internal-pivot
docker compose up -d

The app is at http://localhost:8082. Tear down with docker compose down.

Objectives (2)

  1. 01

    Reach a service that isn't exposed to you at all

    There's more than one container in this lab. One of them has no published port — nothing you can curl directly. Find a way to make the app you *do* have access to fetch it on your behalf.

    ▸Hints (2) — stuck? optional, no spoilers
    1. 1.The preview feature fetches a URL server-side. What happens if you point it at the app itself, or at 127.0.0.1?
    2. 2.The denylist blocks the obvious self-referential hosts. Docker Compose service names also resolve as hostnames — is there a page that lists them?
  2. 02

    Find what that internal service doesn't advertise

    Reaching the internal service once isn't the finish line. It has more than one route, and only one of them is the obvious one.

    ▸Hints (2) — stuck? optional, no spoilers
    1. 1.An internal-only service rarely has just one route, and `/` is rarely the interesting one.
    2. 2.Try common internal-tooling paths — something like `/internal/...` or `/config`.
ssrfinternal-network-pivotdenylist-bypasscloud-metadata-style
View lab source →Solution walkthrough (spoilers) →