Lion Cipher Lab
Find and fix SSRF (Server-Side Request Forgery) in your own lab
- AppSec / DevSecOps
- Intermediate
- ~60 min
- Free · no account required
Why it matters
SSRF — Server-Side Request Forgery — is the bug behind some of the largest cloud breaches of the last decade, and it hides inside the most innocent-looking feature: 'give us a URL and we will fetch it for you.' Link previews, webhook testers, image importers, PDF generators, and 'import from URL' buttons all do this. The danger is that the fetch is made by the SERVER, not the user, so the URL an attacker supplies runs from inside your network — reaching internal admin panels, databases, and the cloud metadata service (a special address that hands out credentials) that no outsider could ever…
What you'll learn
- explaining what SSRF is: making a server fetch a URL the attacker chose, so the server becomes the attacker's proxy into places they cannot reach directly
- building a tiny vulnerable URL-fetcher web app on your own machine with Python and Flask
- running a second local service that stands in for an internal-only or cloud-metadata endpoint
- demonstrating the SSRF: using the public fetcher to read a secret from the internal-only service
- understanding internal IP ranges (loopback 127.0.0.0/8, private 10/172.16/192.168, and link-local 169.254.0.0/16 where cloud metadata lives)
- classifying an address as internal with Python's ipaddress module (is_private, is_loopback, is_link_local, is_reserved)
- fixing the bug with a host allow-list PLUS a block on internal ranges, then re-testing to prove the attack is dead
- closing the redirect and DNS bypass gaps by not following redirects and validating the resolved IP, not just the hostname
Steps in this lab
- What SSRF is — and the ground rules
- Set up: confirm Python, make a folder, install Flask and requests
- Build the internal-only service (the thing that must stay hidden)
- Build the VULNERABLE fetcher (the bug, on purpose)
- Prove the SSRF works (steal the internal secret)
- Know your enemy: what counts as an internal address
- Fix it: allow-list the host AND block internal ranges
- Re-test: confirm the SSRF is dead and the feature still works
- Close the sneaky gaps: redirects and DNS
- What you did — and the reflex to keep