Lab: SSRF with whitelist-based input filter

Summary: PortSwigger's lab presents a stock check feature that fetches data from an internal system, and the task is to change the stock check URL to reach the admin interface at http://localhost/admin and delete the user carlos. The developer has deployed an anti-SSRF defense based on a whitelist input filter that the lab requires the user to bypass.
What you should know: The exercise shows that a whitelist filter alone did not stop the stock check feature from being redirected to an internal admin interface, so any server-side fetch that accepts a user-supplied URL is a path to internal systems until the filter is proven against bypasses.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026