Server Side Request Forgery (SSRF)

Simulated Demo

Demo only; no network requests are made.

Enter an Image URL

Or Upload a File


No image loaded yet.

What does this simulate?

  • The server recieves a user-supplied URL, and if applicable, fetches from the URL
  • There is no proper validation for the user-supplied URL
  • If the URL resolves to an internal address, the server may return sensitive data with no verification necessary

This application can fetch images from URL or from file uploading and displays the result.
Try using the URL localhost:8080/SECRETS!