thinQtankLABS

Web App SSRF: Find, Confirm & Fix (Basic)

Hands-on with Server-Side Request Forgery (CWE-918) in a web app's URL-fetch feature. Safely reproduce it with an inert training tool (reach an internal service and the cloud metadata endpoint), classify it as SSRF, score it with CVSS, then fix it with a host allowlist that blocks link-local/metadata and disables redirects, and verify.

Beginner 20 guided steps 5 tasks About 55 minutes Runs in your browser

Skills you will practice

  • Secure web application concepts; SSRF identification and prioritization; Web application testing; Allowlist-based input validation

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

CompTIA Security+ SY0-701 Secure web application concepts Training at thinQtank Learning CompTIA CySA+ CS0-003 Vulnerability identification and prioritization Training at thinQtank Learning CompTIA PenTest+ PT0-003 Web application testing Training at thinQtank Learning
Part of these certification lab packages: Security+ SY0-701 CySA+ CS0-003 PenTest+ PT0-003 Certified in Cybersecurity (CC) GSEC GSEC GPEN GPEN

The scenario

A penetration test flagged the "Import from URL" feature of Acme Portal as SSRF (CWE-918). You are the app-security engineer. Start by understanding it.

What you will do

  1. Understand the feature and the finding4 steps

    Open the engagement · Read the finding · Which weakness class? · Read the feature config

  2. Reproduce it safely5 steps

    Fetch an allowed URL · Aim it at a loopback service · Reach the cloud metadata endpoint · Review the evidence · …

  3. Assess the severity4 steps

    Find the CVSS vector · Compute the base score · What is the base score? · Why is SSRF to metadata so serious?

  4. Fix it4 steps

    Which fix is right? · Baseline scan · Apply the allowlist config · Confirm the config

  5. Verify3 steps

    Verify with a scan · If it was already exploited? · Document the work

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.