← All labs
SSRF Level 3 / 6 Hard

Blacklist Bypass

localhost and 127.0.0.1 are blocked. Reach the internal service anyway.

Internal URL health check

This tool fetches a URL to check it is up. To stop people probing the box it runs on, requests to localhost are refused.

Reachable internal path for this service: /flag

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.