Lab: SSRF with blacklist-based input filter

Summary: PortSwigger's Web Security Academy lab presents a stock check feature that fetches data from an internal system, and the task is to change the stock check URL to reach the admin interface at http://localhost/admin and delete the user carlos. The lab states the developer deployed two weak anti-SSRF defenses: a request to http://127.0.0.1/ is blocked, but http://127.1/ bypasses it, and http://127.1/admin is blocked until the "a" is double-URL encoded as %2561.
Why it matters: The bypasses here are trivial - an alternate loopback notation and one round of double-encoding - which is the point: a blacklist that catches the obvious string still leaves the internal admin interface reachable, and deleting a user is the demonstrated consequence.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026