Intermediate·300 points·9 solves
Linkscope — Server-Side Request Forgery
Learn server-side request forgery: when a server fetches a user-supplied URL without restricting the destination, an attacker can point it at internal-only services (metadata endpoints, admin panels, databases) that are unreachable from the outside — using the server as a proxy.
Linkscope's /preview endpoint takes a url and fetches it server-side to build a preview. It never checks WHERE the url points, so it will happily fetch internal addresses. This service runs an internal metadata endpoint on 127.0.0.1:9000 that holds an admin API key; that port is bound to loopback and is not published, so you cannot reach it directly — but the Linkscope server can, because 127.0.0.1 from the server's point of view IS the server. Ask Linkscope to preview http://127.0.0.1:9000/ and it fetches the internal page and returns it to you. The fix is to validate the destination: resolve the host and block private/loopback/link-local ranges, allow only an explicit list of external hosts, and disable non-http schemes and redirects.
Your tasks
1
Preview a normal page
Open the lab. Linkscope fetches whatever URL you give it and shows the response. (On this isolated network it can only reach itself — that's fine.)
2
Notice what the server can reach
The fetch happens FROM the server. From the server's perspective, 127.0.0.1 / localhost is the server itself — including internal services not exposed to you.
3
Find the internal service
The page hints that internal services (metadata, admin) live on 127.0.0.1. A metadata service commonly listens on a port like 9000.
4
Make the server fetch it
Give /preview a url pointing at the internal address so the server fetches it on your behalf.
5
Capture the flag
The internal service returns an admin API key — that is the flag.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.