# Linkscope — Server-Side Request Forgery (lab)

> Linkscope previews any URL you paste by fetching it on its server — with no checks on where the URL points. There is an internal metadata service the server can reach but you cannot.

Canonical: https://codelivly.com/labs/ssrf

| | |
|---|---|
| Type | Web |
| Difficulty | Intermediate |
| Points | 300 |
| Session length | 30 min |
| Completions | 9 |

Linkscope previews any URL you paste by fetching it on its server — with no checks on where the URL points. There is an internal metadata service the server can reach but you cannot. Make Linkscope fetch that internal address for you and read the admin key it holds.

## Objective

Learn server-side request forgery: when a server fetches a user-supplied URL without restricting the destination, an attacker can point it at internal-only services (metadata endpoints, admin panels, databases) that are unreachable from the outside — using the server as a proxy.

## Tasks

1. Preview a normal page
2. Notice what the server can reach
3. Find the internal service
4. Make the server fetch it
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)